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Purpose 


In the current school climate, the health and safety of students, staff, and visitors has become 
paramount. Commensurate with this concern is the need for school and law enforcement personnel to 
have the ability to access and share critical student educational, health and safety related information 
while balancing this need with the student’s protected right of privacy. To that end, this information 
sharing guide is intended to serve as a resource for school and law enforcement personnel to help them 
identify issues for discussion with their legal counsel when considering how they can share and/or 
access pertinent student information in an effective and timely manner.’ This guide focuses on the ways 
in which administrators, teachers, counselors, threat assessment teams, and members of law 
enforcement can work with their legal counsel to carry out their mission of risk reduction, while 
respecting the requisite confidentiality of the student. 


Accordingly, this guide focuses primarily on the Family Educational Rights and Privacy Act (FERPA), which 
protects the confidentiality of student education records and the personally identifiable information 
(PII) contained therein, as well as attendant Virginia law that serves as the basis for student record 
confidentiality. The Health Insurance Portability and Accountability Act (HIPAA), which protects the 
confidentiality of student medical records, rarely applies to public schools since most school records, to 
include counseling and school nurse records, are covered by FERPA. Therefore, the primary thrust of this 
guide is geared towards FERPA as FERPA provides students with certain privacy rights, but also gives 
schools and divisions flexibility to disclose Pll, in health and safety emergencies and other specified 
circumstances, as summarized below and described in more detail in applicable regulations. The 
purpose of this guide is to highlight questions about how FERPA applies to schools’ and divisions’ 
disclosures of PII from student education records to school officials, school security units, outside law 
enforcement entities, school resource officers (SROs), other schools, and otherwise. 


FERPA affords schools and divisions flexibility when responding to circumstances that could threaten the 
health or safety of individuals in their school community. Understanding the provisions of FERPA relative 
to such circumstances will facilitate conversations between school officials and their legal counsel, so 
that decisive, quick action can be taken when challenges arise. The following frequently asked questions 
detail how FERPA may apply in these circumstances. Although this guidance is focused on FERPA, there 
may be other federal and state laws, such as civil rights and privacy laws that are also relevant to 
decision-making about students. At the federal level, for example, public elementary and secondary 
schools are subject to federal civil rights laws, including laws that prohibit discrimination based on: 
disability (the Americans with Disabilities Act (ADA) and Section 504 of the Rehabilitation Act of 1973); 
race, color, and national origin (Titles IV and VI of the Civil Right Act of 1964); sex (Title IX of the 
Education Amendments of 1972); and religion (Title IV of the Civil Rights Act of 1964). Information 
disclosure decisions are not likely to implicate these laws, however, so long as decisions are made ina 
non-discriminatory manner. Also, state educational agencies and local educational agencies must 
comply with the requirements of Part B of the Individuals with Disabilities Education Act (IDEA) in 
educating children with disabilities, including IDEA’s confidentiality of information requirements. 


The second part of this guide focuses on Mental Health Care Providers: The Duty to Warn in terms of 
the types of records that relate to the health and medical treatment of a student, including their 
physical as well as their mental health. It also delineates the circumstances under which school 
personnel, including threat assessment team members and law enforcement personnel, may access 


1 This guide is not intended to provide legal advice, and should not be viewed as a substitute for legal advice from legal counsel 
consulted specifically by schools, divisions and/or law enforcement entities to provide such advice regarding the legal rules 
and considerations that apply in particular circumstances. Schools, divisions and law enforcement entities are encouraged in 
all cases to seek legal advice from their own counsel regarding the types of issues that are highlighted, in introductory, 
summary form only, in this guide. 
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otherwise confidential student medical records, and under what conditions that information can be 
shared and with whom. 


Finally, this guide sets forth practical considerations for developing a Memorandum of Understanding 
between schools and law enforcement that addresses key information sharing issues. 
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|. Understanding and Navigating the 
Family Educational Rights & Privacy Act (FERPA) — 
Frequently Asked Questions 


A. What is FERPA and who does it apply to? 


FERPA is a federal law the purpose of which is to protect the rights and privacy interests of both 
parents and students in regard to the student’s education records. FERPA regulations are found 
in Title 34 of the Code of Federal Regulations, Part 99. FERPA was designed to protect the 
education records of the student maintained by educational agencies or institutions. 
Educational agencies and institutions generally refers to local educational agencies, elementary 
and secondary schools, and post-secondary institutions. 


Federal Law — FERPA 
Statute: 20 USC § 1232(g) 
Regulations: 34 C.F.R. Part 99 


Virginia Law 

Virginia Education Code: Title 22.1, Chapter 14, Article 5: Pupil Records 

Board of Education Regulations: Administrative Code, Chapter 150: Management of the 
Student’s Scholastic Record in the Public Schools of Virginia — § 10 (Definitions), § 20 
(Management of Records), § 30 (Access) 


B. What are the rights of parents under FERPA? 


The main thrust of FERPA was essentially to provide four basic rights: 

e To provide the parent the right to inspect and review their child’s education record. 

e To allow the parents the right to request an amendment to those records by way of a 
specified process. 

e To provide the parent with some right of control over the disclosure of information from those 
education records by requiring the school division to obtain the “prior consent” of the parent 
before such information is disclosed, unless an exception applies. 

e To provide the student the right, upon turning 18 or upon entering college, to have the 
parent’s control over the record transferred with all existing rights to the student. The 
student, upon turning 18 or entering college, becomes “an eligible student” thereby obtaining 
full rights over the records. 


FERPA also requires school divisions to notify parents and eligible students on an annual basis of 
their specific rights under the Act. 


For more detailed information, please see Question 4 of Appendix A. 
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C. What is included in the “education record” of the student? 


FERPA defines Education Records as: records that are (1) directly related to the student and 
(2) maintained by an educational agency or institution or by a party acting for the agency or 
institution.” 


The term “education record” can include the following examples: 

e Assessments 

e Correspondence between schools about students 

e Disciplinary records 

e Health records 

e Information about parents 

e Personally identifiable information (PII) on students — e.g.: student’s name, parents/family 

members names; address; social security number and other personal identifiers; indirect 
identifiers such as date and place of birth and mother’s maiden name; other information that, 


alone or in combination, is linked or linkable to a specific student that would allow a reasonable 


person in the school community, who does not have personal knowledge of the relevant 


circumstances, to identify the student with reasonable certainty; or information requested by a 
person who the educational agency or institution reasonably believes knows the identity of the 


student to whom the education record relates. 


NOTE: The general rule is that schools must obtain prior, written consent of a parent to 
disclose Pll, and must make a record of the consent, as well as a record of the disclosure of 
that information without consent when an exception to the consent requirement applies. 


For more detailed information, please see Questions 8—12 of Appendix A. 


Report cards 

Surveys that yield personally identifiable information 

The education record of the student may also include other materials such as films, tapes, 
video recordings or photographs containing information directly related to a student and that 
are maintained by an educational agency or institution or person acting for the agency. 


For more detailed information, please see Question 5 of Appendix A. 


Examples of what are NOT education records: 


Records that are kept in the sole possession of the maker, are used only as a personal memory 
aid, and are not accessible or revealed to any other person except a temporary substitute for 
the maker of the record. 

Records of a law enforcement unit of an educational agency or institution subject to the 
provisions of Section 99.8 of the FERPA regulations. Please note: a “law enforcement unit” for 
FERPA purposes may be represented by a school resource officer or other sworn law 
enforcement officer, but that need not necessarily be the case. Under FERPA, “law 
enforcement unit” means “any individual, office, department, division, or other component of 


2 In Owasso Independent School District v. Falvo, 534 U.S. 426 (2002), the U.S. Supreme Court references the ordinary 
definition of “maintain” and cites it to mean “to keep in existence or continuance; preserve, or retain.” The Court further 
states that as this definition applies to education records maintained by a school, the word “maintain” “suggests that FERPA 
records will be kept in a filing cabinet in a records room at the school or on a permanent, secure database perhaps even after 
the student is no longer enrolled.” The Court cites as an example a school registrar maintaining a student’s folder ina 
permanent file. Of course, these are only examples, and other means of maintaining records could also result in 
“maintained” education records covered by FERPA. 
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an educational agency ... such as a unit of commissioned police officers or non-commissioned 
security guards, that is officially authorized or designated by that agency ... to- ... Maintain the 
physical security and safety of the agency ... Acomponent of an educational agency ... does 
not lose its status as a ‘law enforcement unit’ if it also performs other, non-law enforcement 
functions for the agency ... including investigation of incidents or conduct that constitutes or 
leads to disciplinary action or proceedings against the student.” 34 C.F.R. § 99.8. A February, 
2019 U.S. Department of Education Privacy Technical Assistance Center (“PTAC”) publication, 
“School Resource Officers, School Law Enforcement Units, and the Family Educational Rights 
and Privacy Act (FERPA)” (attached as Appendix A) gives the example that while some larger 
school districts may have their own fully equipped police units, others may have “smaller 
security offices,” and “[o]ther schools designate a vice principal or other school official to act 
as the law enforcement unit officer.” Appendix A at Q. 18. Thus, any individual, office or other 
component of a school officially authorized or designated by a school to, among other duties, 
maintain the security and safety of the school, can be a “law enforcement unit” for FERPA 
purposes. 


Reference: 34 C.F.R., Section 99.3; 20 U.S.C. 1232g(b)(3)b(5). See also Joint Guidance on the 
Application of the Family Educational Rights and Privacy Act (FERPA) And the Health Insurance 
Portability and Accountability Act of 1996 (HIPAA) To Student Health Records (Dec. 2019) at Q 
23 (available at: 
https://studentprivacy.ed.gov/sites/default/files/resource_document/file/2019%20HIPAA%20 


FERPA%20Joint%20Guidance%20508.pdf). 


D. What does FERPA protection of a record mean? 


FERPA protection, in its simplest terms, means that an individual or entity requesting disclosure 

of a student education record may only be permitted access to it if one of three conditions has 

been met: 

e The individual or entity has obtained the prior, written consent of the parent to access that 
particular record if the student is under the age of 18. 

e The individual or entity has obtained the prior, written consent of the student to access that 
particular record if the student is 18 or older. 

e Disclosure is permitted under one of the conditions in which prior consent is not required to 
disclose information. (see Question F: Under What Conditions is Prior Consent Not Required to 
Disclose Student Education Record Information? 


Example: A local employer who regularly hires high school students visits the high school to 
request a copy of a student’s grade transcript. The student had filled out an application for 
employment but did not attach their transcript as requested. None of the FERPA disclosure 
without consent conditions (discussed more below) apply, so therefore, the employer must 
obtain the prior, written consent of the parent if the student is under the age of 18, or the 
student if the student is 18 or older, before the transcript can be disclosed. 


E. What are examples of types of information that are not covered by FERPA (i.e., 
no parental consent required for release)? 
Example 1: Investigative Statements Acquired from Students 
e For FERPA purposes, any verbal statement acquired from a student or witness during the 


course of a school investigation or in another context that is not reduced to writing or 
otherwise recorded (electronically or otherwise) would not be an education “record” and 
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could therefore be shared with law enforcement officers, parents or others as necessary and 
appropriate. 

e Ifthe statement is obtained during the course of a school disciplinary investigation for school 
disciplinary purposes and documented in any form, it may not be shared with law 
enforcement officers for the purpose of pursuing a criminal investigation and determining 
whether the statement contains any evidence of criminal activity or involvement in a crime, 
absent a subpoena or other applicable exception. 


Example 2: School Cameras — Students on Film 

e Schools across Virginia have exercised their right to place cameras in legally approved areas 
within the three school authority zones in Virginia, which are school buildings and grounds, 
school buses and other official school transportation vehicles, as well as school-sponsored 
activities. The purpose of the camera system is to gather evidence of school violations which 
may or may not be criminal acts. 

e Schools own the cameras and the film or digital video files. Film or digital files which contain 
images of students and the actions recorded are not FERPA records if the camera and 
recording system are maintained by a component that is responsible for maintaining the 
security and safety of the school and are created for a law enforcement purpose (i.e., they are 
“law enforcement unit records”, as defined above). In such circumstances, the film may be 
used as evidence for purposes of a criminal prosecution, and may be shared with outside law 
enforcement officers without a subpoena or other FERPA exception. Further, if such records 
were not created by a law enforcement unit exclusively for a non-law enforcement purpose 
(i.e., they were created at least in part for a law enforcement purpose), they may be shared by 
the law enforcement unit with school officials for disciplinary or other purposes at the 
discretion of the law enforcement unit; such records would be education records covered by 
FERPA in the hands of such school officials. 

e If film or digital video files are maintained by an individual or office other than a school’s law 
enforcement unit they are covered by FERPA. As such, they may be reviewed by school 
officials with a legitimate educational interest (which may include a school resource officer 
acting in the capacity of a school official as discussed below), but are otherwise only subject to 
disclosure if a FERPA exception (e.g., health or safety emergency, subpoena, etc.) applies. 


Example 3: Personal Observations 

e Because FERPA applies to the disclosure of education records and PII from education records 
maintained by a school, FERPA does not prohibit a school official from releasing information 
that was obtained through that school official’s personal knowledge or observation, or 
verbally from another person based on the other person’s personal knowledge or observation, 
rather than from the student’s education records. It should be noted, however, that this 
general rule does not apply where a school official learns of information about a student 
through their role in making a determination (e.g., a disciplinary decision) about the student 
that is maintained in an education record. 


For more detailed information, please see Questions 36—37 of Appendix A. 


NOTE: It is important to remember that because FERPA governs record access only, it does 
not cover oral communications, observations, oral history, reactions, or opinions that are 
related to a student, the things they say to school officials, or their observed actions. 
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Where not derived from education records maintained by the school and falling instead within 
the scope of personal observation and knowledge described here, information about the 
following topics, among others, may be exchanged by school and law enforcement personnel: 
e Communicated threats of violence 

e Harassment, intimidation and/or bullying 

e Stalking 

e Suicidal ideation 

e Threatening behavior 

e Unusual or significantly disruptive behavior 


Of course, the health and safety emergency exception and other exceptions summarized in this 
guide may also permit the sharing of information about such issues, even if that information is 
maintained in education records. 


Example 4: Evidence Acquired from School Searches and Investigations 


Information derived from school searches of the student’s person and/or their belongings, which 
may or may not yield evidence of a school violation or violation of law, including texts, emails, 
pictures, symbols, drawings, substances, liquids, and devices, to the extent it is limited to 
personal observations, would fall outside the scope of of FERPA. Therefore, such information 
obtained from a school search may be disclosed verbally to appropriate school officials and law 
enforcement, if applicable, without the prior consent of the parent. 


NOTE: It is important to emphasize however that documents created by a school regarding 
such searches would become student education records, and therefore could only be 
disclosed if a FERPA exception applies. 


F. Under What Conditions is Prior Consent Not Required to Disclose Student 
Education Record Information? 


No prior parental consent is required to disclose student education records, or information from 
such records, under numerous conditions specified by FERPA. Some notable examples are 
described here. 


e School Officials: FERPA-protected records and information from such records may be 
disclosed to and shared with other school officials, including but not limited to teachers, 
within the school or school division who have been determined to have legitimate educational 
interests in reviewing the records and information. A school official has a legitimate 
educational interest if the official needs to review an education record in order to fulfill his or 
her professional responsibility. 


See § 99.31 (a) (1) of Appendix B. 


NOTE: A school official may include but is not limited to a teacher, school principal, 
president, chancellor, board member, trustee, registrar, counselor, admissions officer, school 
attorney, accountant, human resources professional, information systems specialist, and 
support or clerical personnel. 


As discussed briefly at Question G, a law enforcement officer may be considered a school 
official under the requirements set forth under the Law Enforcement Section of Appendix A. 
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A contractor, consultant, volunteer or other party to whom a school has outsourced institutional 

services or functions may also be considered a school official for purposes of FERPA provided that 

such outside party: 

e Performs an institutional service or function for which the school or division would otherwise 
use employees; and 

e ls under the direct control of the school or division with respect to the use and maintenance 
of the education records; 

e Are subject to FERPA’s use and re-disclosure requirements set forth in 34 CFR § 99.33(a); and 

e Must satisfy the criteria specified in the schools’ or divisions’ annual notification of FERPA 
rights for being “school officials” with “legitimate educational interests” in the education 
records. 


NOTE: The focus of the “direct control” criterion is that such outside party must be under the 
direct control of the school with respect to their handling of education records. The person 
receiving the information does NOT have to be under the control or employment of the 
school for all purposes. If an outside individual meets the criteria specified above and is 
bound by an agreement between the school and the individual and/or the individual’s 
employer that defines how the individual may and may not access and disclose FERPA- 
covered education records, that would satisfy the direct control requirement for FERPA 
purposes. 


For an extensive list of additional persons who may qualify, and other more detailed 
information, please see Question 13 of Appendix A. 


e Officials of Other Schools: If certain notice and procedural requirements are satisfied, FERPA- 
protected records and information in such records may be disclosed to officials of another 
school, school system, or postsecondary institution where the student seeks or intends to 
enroll. 


For detailed information on the rules that govern schools’ disclosing education records of a 
student or transferring certain student disciplinary records to other schools, please see 
Questions 33-34 of Appendix A. See also §§ 99.31(a)(2) and 99.34 of Appendix B. 


e Juvenile Justice System: FERPA-protected records and information from such records may be 
disclosed to state and local officials or authorities in compliance with a state statute that 
concerns the juvenile justice system and the system’s ability to effectively serve, prior to 
adjudication, the student whose records are being released. (See §§ 99.31(a)(5) and 99.38 of 
the FERPA regulations). 


See also Title 22 of the Virginia Education Code, 22.1-287.1, which is discussed in detail in the 
Law Enforcement Section and Question 35 of Appendix A. 


e Subpoenas and Court Orders: FERPA-protected records and information in them may be 
disclosed in order to comply with a judicial order or lawfully issued subpoena. The regulations 
direct the school to make a reasonable effort to notify the parent or eligible student of the 
court order or subpoena in advance of compliance. This notification requirement is eliminated 
for instances in which a court or other agency issues either a Federal Grand Jury subpoena or 
a subpoena for a law enforcement purpose and the court or issuing agency has ordered the 
school not to disclose the existence of the subpoena. 


See § 99.31(a)(9) of Appendix B and Question 32 of Appendix A. 
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e Health or Safety Emergencies: FERPA-protected records and information in them may be 
disclosed in connection with a health or safety emergency. (See § 99.31(a)(10)of the FERPA 
regulations). This type of an emergency pertains to a specific and articulable threat such as a 
campus threat, a natural disaster, a terrorist attack, or disease outbreak. Information may be 
communicated in such circumstances not only to law enforcement and other emergency 
personnel but also to other appropriate parties in connection with an emergency, if 
knowledge of the information is necessary to protect the health or safety of the student or 
other individuals. It should be noted that the school official exception allows the school to 
share personally identifiable information about the student with an individual acting as a 
school official with a legitimate educational interest (e.g., a threat assessment team member 
or a school resource officer who qualifies as a school official with a legitimate educational 
interest) to determine whether or not a health or safety emergency exists, and otherwise to 
school officials who have a legitimate educational interest in the behavior of the student. 


NOTE: Although the U.S. Department of Education will not substitute its judgment for that of 
the educational agency or institution when there is a rational basis for a determination that a 
health or safety emergency existed, this exception only applies DURING the health or safety 
emergency and only allows the sharing of those records necessary to address the emergency, 
which may not be sufficient to support release of information to allow ongoing resolution of 
a threat case. Although this is one path of information sharing that could be used by a threat 
assessment team, it should not be the ONLY or the primary one. Threat assessment teams 
should be well versed in other FERPA exceptions as well. 


For more detailed information, please see Questions 25-30 of Appendix A. 


e Disciplinary Action for Conduct that Posed a Significant Risk: To teachers and school officials 
in other schools who have legitimate educational interests in the behavior of the student 
when the information concerns disciplinary action taken against the student for conduct that 
posed a significant risk to the safety or well-being of that student, other students, or other 
members of the school community. 


For further explanation and example, please see Question 31 of Appendix A. See also § 99.36 of 
Appendix B. 


e Directory Information: Under FERPA, “directory information” may generally be disclosed 
without consent if certain conditions are met, even though it is personally identifiable (Virginia 


law, however, imposes certain restrictions). 


See § 99.37 of Appendix B. 
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FERPA defines directory information as information contained in a student’s record that would 
not generally be considered harmful or an invasion of privacy if disclosed, such as the following: 
o The student’s name 

The student’s address and telephone number? 

The student’s date and place of birth 

The student’s major field of study 

Official activities that the student participates in, such as officially recognized sports and 

other school-related activities 

o The student’s dates of attendance at that particular school, including enrollment date and 
leave date which would also include date of graduation, if applicable 

o The weight and height of the student if the student is a member of an athletic team 

o Degrees, honors and awards received by the student 

o Name and address of most recent school or educational institution that the student had 
previously attended 

o A photograph of the student 


Oo 
oO 
1e) 
12) 


A school or division may disclose directory information without the parent or eligible student’s 
written consent to third parties, including law enforcement officials, if it has given public notice 
to those parents or students of: 
=" The types of personal information that it has designated as directory information; 
= The right of the parent or eligible student to restrict the disclosure of such information; 
=" The period of time within which a parent or eligible student has to notify the 
educational agency or institution in writing that they do not want any or all of that 
information listed as directory information. 
If a parent or eligible student follows a school’s procedures to notify the school that they do not 
want any or all of that information listed as directory information, the school must respect that 
request and only disclose such information without consent if another FERPA exception allows 
disclosure. 


For more information, please see Questions 7 and 23 of Appendix A and § 99.37 of Appendix B. 


e Law Enforcement Unit Record: Law enforcement unit records are exempt from FERPA 
protection and no prior consent from the parent or eligible student is required for them to be 
released. (See Section C for definition of “education records”). 

o Law Enforcement Unit: As noted above, a “law enforcement unit” for FERPA purposes is 
any individual, office, department, or division of a school that is designated to enforce the 
law and/or maintain the physical security of the school, and may include law enforcement 
officers, security guards, or designated school officials. Schools may use non-school 
employees, such as local law enforcement officers and SROs, as their designated law 
enforcement unit. 


3 It should be noted however, that while the Code of Virginia likewise permits the disclosure of some FERPA-designated 
directory information if FERPA notice and opt-out procedures are followed, it also provides: “However, no school shall 
disclose the address, telephone number, or email address of a student pursuant to the Virginia Freedom of Information Act 
(§ 2.2-3700 et seq.) unless the parent or eligible student has affirmatively consented in writing to such disclosure. 
Additionally, except as required by state or federal law, no school shall disclose the address, telephone number, or email 
address of a student pursuant to 34 C.F.R. § 99.31(a)(11) unless (a) the disclosure is to students enrolled in the school or to 
school board employees for educational purposes or school business and the parent or eligible student has not opted out of 
such disclosure in accordance with this subsection and school board policy or (b) the parent or eligible student has 
affirmatively consented in writing to such disclosure.” Code of Virginia § 22.1-287.1 (emphasis added). Thus, a student’s 
address, telephone number and email address must be treated with additional care notwithstanding that FERPA permits 
their disclosure if a parent does not opt out; instead, they may only be disclosed given the requirements of Virginia law if a 
parent affirmatively consents in writing to such disclosure. 
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For more information, please see Questions 18-24 of Appendix A and § 99.8 of Appendix B. 


NOTE: An individual or group of individuals who serve as a law enforcement unit may be 
considered a school official with a legitimate educational interest in reviewing FERPA-covered 
records without parental consent if they meet all of the requirements of school official under 
FERPA as set forth previously. 


For more information, please see Questions 13-15 of Appendix A. 


o Law Enforcement Unit Record: A law enforcement unit record is a record that is: 
=" Created by a law enforcement unit 
= Created at least in part for a law enforcement purpose (such as the prevention of 
violence) 
=" Maintained by the law enforcement unit 


For more detailed information, please see Questions 18-22 of Appendix A. 


G. How can law enforcement officers gain access to student records under FERPA? 


e Title 22 Virginia Education Code: Under Section 22.1-287 of the Code of Virginia, a school 
official may permit local law enforcement to access a student’s record for the purpose of 
seeking information related to the duties of that particular law enforcement officer and also 
may disclose identifying information from a student’s record for the purpose of furthering the 
ability of the juvenile justice system to effectively serve the student prior to adjudication.* 

e Court Order/Subpoena Exception: A LEO can access protected FERPA information from a 
school record if the requirements of this exception are met as previously discussed. 

e Health or Safety Emergency Exception: A LEO can access protected FERPA information from a 
school record if the circumstances presented qualify under this exception as previously 
discussed. 

e LEO Acting as School Official Exception: If a LEO meets all of the requirements of being a 
school official, they can access protected FERPA information from a school record; however, 
they generally cannot provide protected student education record information to their home 
police agency unless another exception (e.g., the subpoena exception) applies that would 
allow any other school official to do so. 


For more detailed information and the definition of a school official, please see Questions 13, 
14, 15, 22, & 24 of Appendix A. 


4 In a2013 advisory opinion, Virginia’s attorney general stated that Section 22.1-287 could be reconciled with FERPA where 
FERPA’s health or safety emergency exception applies, on the following rationale: “The disclosure permitted under § 22.1- 
287(A)(5) falls within the scope of FERPA's parallel emergency-related exception to nondisclosure. As noted, the exception at 
subsection (A)(5) permits disclosure to State or local law-enforcement or correctional personnel seeking information in the 
course of his duties. An educational agency could comply with both FERPA and this state law provision if it were to disclose 
information to law enforcement personnel in connection with an emergency, when the knowledge of such information is 
necessary to protect the health or safety of the student or other persons.” Office of the Attorney General, Commonwealth of 
Virginia, Opinion No. 12-096, 2013 WL 1942389 (Va. A.G.) (May 3, 2013). The advisory opinion noted, however, that 
disclosure to law enforcement is however permissive and it is up to the school to decide whether FERPA’s health or safety 
exception applies under the circumstances at issue. Specifically, the advisory opinion states: “If, however, upon taking into 
account the totality of existent circumstances, the educational agency does not conclude that the facts meet the criteria for 
the FERPA exception, information about the pupil may not be released.” Id. 
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H. What is a “threat assessment team”? 


Generally, a threat assessment team is a group of individuals who collaborate to identify, 
evaluate, and address threats or potential threats to school or campus safety. Teams review 
incidents of current and former threatening behavior by students, parents, school or campus 
employees, or other individuals. 


For more information, please see Question 16 of Appendix A and reference Title 22 of Virginia 
Education Code (§ 22.1-79.4). 


1. What does Virginia law provide with respect to threat assessment teams? 


For public schools in Virginia, the Virginia Education Code dictates what backgrounds team 
members must possess. For K-12 schools, team members must consist of (at a minimum) 
individuals with expertise in, school administration, instruction, counseling/mental health, and 
law enforcement. 


Title 22 of Virginia Education Code § 22.1-79.4 contains provisions regarding the oversight and 
purpose of a threat assessment team. 


Members of the team may gain access to individual (including student) health records and adult 
or juvenile criminal history records if the individual/student: 

e poses a threat of violence to themselves or others. 

e exhibits significantly disruptive behavior. 

e demonstrates a need for assistance*. 


*Although not explicitly defined, the “need for assistance” has included the need for parental 
notification and involvement, behavioral intervention, evaluation and management, and in-house 
counseling or outside referral. 


Members of a threat assessment team may NOT re-disclose any criminal history or health 
records, and may not use the record(s) for any purpose beyond the purpose for disclosure to the 
threat assessment team. 


Juvenile criminal history records may NOT be placed in student educational records. 


Under FERPA, if threat assessment team members are functioning as “school officials with a 
legitimate educational interest” (i.e., they need to review or learn information from student 
education records in order to fulfill their professional responsibilities as threat assessment team 
members) they may also access all student education records on the same terms that other 
school officials may do so. 


See also Title 19 of Virginia Code, § 19.2-389 and 19.2-389.1 (Juvenile Criminal History Records) 
and Title 32 of Virginia Code, § 32.1-127.1:03 (Health Records). 


J. Does FERPA permit schools and divisions to allow access to educational records 
without prior consent to members of the school’s threat assessment team? 


Yes, under certain conditions. The Department of Education has long encouraged schools and 
divisions to implement a threat assessment program that relies on teams composed of a wide 
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variety of individuals, including outside law enforcement officials, mental health officials, and 
other experts in the community in addition to members of the team who serve as school officials. 
The school division may disclose personal identifiable information (PII) from education records 
without the prior consent of the parent to threat assessment team members, so long as each 
member qualifies as a “school official with a legitimate educational interest” who meets the 
institutional service or function, “direct control”, annual notification and re-disclosure 
requirements outlined in Question F above. 


For more detailed information, please see Question 17 of Appendix A. 


K. How does FERPA apply to the Virginia school threat assessment process? 


It is only when there is an attempt to access information obtained directly from a student’s 
education record that FERPA protection applies. Consider the following: 


Scenario: A student posts a threat on Facebook and references a recent school shooting. The 
student was involved in a prior altercation and specifically related to that altercation, he 
informed another student he would bring a gun to school to settle the score, which lead to the 
resulting Facebook posting. 


In response to this posed threat, school and law enforcement officials may act immediately and 
cultivate information from what they hear, see, and otherwise sense regarding the incident. They 
may also consider prior observations and communications of the student, the reaction of the 
student once confronted, and the atmosphere within the school related in any way to the 
incident. 


Some key law enforcement options are: 

e Interviewing students, parents, and witnesses; 

e Obtaining a lawful search warrant, if circumstances permit, to search the student’s house; and 

e Conducting a lawful search of the student based upon probable cause before the student re- 
enters the school zone. 


Some key school options are: 

e Interviewing students and witnesses; 

Meeting with the parents to gain an understanding of the student’s home environment and 
circumstances surrounding the incident; 

Performing a lawful search of the student and/or their belongings based upon reasonable 
suspicion of a potential school violation that is related to the incident; and 

Determining the appropriate process for handling the incident through the school’s threat 
assessment team protocols. 


NOTE: Beyond information regarding a social media threat and direct observations/ 
knowledge, the school officials who are TAT members may also review school records to 
determine if there are other issues that would inform understanding of the threat posed and 
how best to manage it in an ongoing fashion. Further, as noted above, FERPA may allow 
disclosure of education record information if the health or safety emergency exception is 
deemed to apply, if a subpoena is received, or if another FERPA exception applies. 
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Il. Mental Health Care Providers: The Duty to Warn 


L. Do mental health service providers working in schools (i.e. school counselors, 
social workers, psychologists) have a duty to release information when a third 
party may be at risk? 


Yes, under Code of Virginia Title 54.1, Chapter 24, § 54.1-2400.1. Mental Health Service 
Providers; Duty to Protect Third Parties; Immunity. Subsection B states the following: 


A mental health service provider has a duty to take precautions to protect third parties from 
violent behavior or other serious harm only when the client has orally, in writing, or via sign 
language, communicated to the provider a specific and immediate threat to cause serious bodily 
injury or death to an identified or readily identifiable person or persons, if the provider reasonably 
believes, or should believe according to the standards of his profession, that the client has the 
intent and ability to carry out that threat immediately or imminently. If the third party is a child, 
in addition to taking precautions to protect the child from the behaviors in the above types of 
threats, the provider also has a duty to take precautions to protect the child if the client threatens 
to engage in behaviors that would constitute physical abuse or sexual abuse as defined in 

§ 18.2-67.10. The duty to protect does not attach unless the threat has been communicated to the 
provider by the threatening client while the provider is engaged in his professional duties. 


Subsection C of § 54.1-2400.1 provides that the duty to take precautions to protect third parties 
may be satisfied by: 1) seeking involuntary admission of the client under applicable Virginia law; 
2) making reasonable attempts to warn the potential victims or the parent or guardian of the 
potential victim if the potential victim is under the age of 18; 3) making reasonable efforts to 
notify a law-enforcement official having jurisdiction in the client's or potential victim's place of 
residence or place of work, or place of work of the parent or guardian if the potential victim is 
under age 18, or both; 4) taking steps reasonably available to the provider to prevent the client 
from using physical violence or other means of harm to others until the appropriate law- 
enforcement agency can be summoned and take custody of the client; 5) providing therapy or 
counseling to the client or patient in the session in which the threat has been communicated 
until the mental health service provider reasonably believes that the client no longer has the 
intent or the ability to carry out the threat; and/or 6) in the case of a registered peer recovery 
specialist, or a qualified mental health professional who is not otherwise licensed by a health 
regulatory board at the Department of Health Professions, reporting immediately to a licensed 
mental health service provider so that they can take one or more of the actions set forth above. 


NOTE: In Virginia Code Section 54.1-2400.1 "Mental health service provider" or "provider" 
refers to any of the following: (i) a person who provides professional services as a certified 
substance abuse counselor, clinical psychologist, clinical social worker, licensed substance 
abuse treatment practitioner, licensed practical nurse, marriage and family therapist, mental 
health professional, physician, physician assistant, professional counselor, psychologist, 
qualified mental health professional, registered nurse, registered peer recovery specialist, 
school psychologist, or social worker; (ii) a professional corporation, all of whose 
shareholders or members are so licensed; or (iii) a partnership, all of whose partners are so 
licensed. 


Although School Counselors are not defined in legislation as mental health service providers, 
in Virginia, they are governed by the Ethical Standards for School Counselors (ASCA 2016), 


DCJS — Information Sharing Guide for K-12 Public Schools 14 


section A.2.e. of which states that counselors must “Keep information confidential unless 
legal requirements demand that confidential information be revealed or a breach is 
required to prevent serious and foreseeable harm to the student. Serious and foreseeable 
harm is different for each minor in schools and is determined by students’ developmental 
and chronological age, the setting, parental rights and the nature of the harm.” The ASCA 
standards also provide that “[s]chool counselors [should] consult with appropriate 
professionals when in doubt as to the validity of an exception.” School Counselors are also 
bound by mandated reporter guidelines, which reinforce the duty to inform of potential 
harm. 


Reference Virginia Code Section 54.1-2400.1 available at 
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Ill. Memorandums of Understanding 
and Information Sharing 


M. What is the key to making information sharing work? 


The key is a viable Memorandum of Understanding, which serves as a vital tool for school and 
law enforcement personnel to share health and safety-related information and other information 
as permitted by FERPA without violating the student’s/patient’s right of privacy. 


Memorandums of Understanding, for purposes of information sharing, should be substantive in 
nature and serve as an operational template to be utilized on a daily basis. It is suggested that 
the following components should be considered: 


School and law enforcement personnel have broad discretion to, at the very least, 
immediately share information regarding a potential health or safety emergency where doing 
so is necessary to protect the health or safety of a student or other individuals. 

There should be a consensus on what general criteria will provide school personnel with a 
comfort level to allow law enforcement to access necessary student records with the 
understanding that the access to those records can be limited by statutory protection at both 
the Federal and Commonwealth levels for both parties, consistent with the principles 
summarized above and outlined in more detail in Appendix A and Appendix B. 

In accordance with § 22.1-79.4 of the Code of Virginia, which authorizes and requires schools 
to establish threat assessment policies and procedures, form a threat assessment team (for 
which law enforcement representation is required), and provide guidance to students and 
staff on recognizing and reporting threatening or aberrant behavior. 

Emphasize the provision of § 8.01-47 of the Code of Virginia, as it grants immunity from civil 
liability to any person who, in good faith, reports to authorities actions or behavior that may 
pose a threat to others. 

Recognize that electronic devices may hold key insights into the mindset of students when 
behaviors resulting in threats to safety are exhibited. School officials are therefore encouraged 
to incorporate a clear policy and procedure for the seizure and search of electronic devices 
and the requisites for doing so under criminal law by a law enforcement officer, and under 
civil law by a school official. Information gathered by law enforcement is not protected by 
FERPA, but is subject to laws as they pertain to seizure and search in the Commonwealth. 
Understand that while school officials and law enforcement should reach agreement on 
sharing information whenever circumstances allow, especially when time is of the essence, a 
subpoena, search warrant, and/or court order may be necessary to obtain the information 
sought in some instances. 


For more detailed information, please see Appendix C. 
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Summation 


FERPA and Virginia law clearly allow school personnel the discretion to share information, including 
student education record information, with law enforcement under conditions summarized above and 
detailed in appendices A and B, and to take steps to prevent, reduce, and/or respond to safety concerns 
that arise within the school environment or originate from outside the school environment. The bottom 
line is that school and law enforcement officials should have a common understanding that prioritizes 
the safety of students, staff, and officers while protecting student privacy rights, and should develop a 
formula for exchanging critical information that includes disclosure of records when appropriate and 
necessary. It is critical to leverage the many options afforded under FERPA and Virginia law, as set forth 
above and in the appendices, that can reduce the risk to all and promote school safety. 
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Appendices 
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Appendix A 


School Resource Officers, School Law Enforcement Units, and the Family Educational Rights 
and Privacy Act (FERPA) developed by U.S. Department of Education established the Privacy 
Technical Assistance Center (PTAC). 
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—_— Privacy Technical Assistance Center 


CC. U.S. Department of Education *y 
ry (855)249-3072 
& privacyTA@ed.gov t= 


£2 https://studentprivacy.ed.gov 


School Resource Officers, School Law Enforcement Units, and 
the Family Educational Rights and Privacy Act (FERPA) 


About PTAC 


The U.S. Department of Education established the Privacy Technical Assistance Center (PTAC) as a 
“one-stop” resource for education stakeholders to learn about data privacy, confidentiality, and security 
practices related to student-level longitudinal data systems and other uses of student data. PTAC 
provides timely information and updated guidance through a variety of resources, including training 
materials and opportunities to receive direct assistance with privacy, security, and confidentiality of 
student data systems. More PTAC information is available at https://studentprivacy.ed.gov. PTAC 
welcomes input on this document and suggestions for future technical assistance resources relating to 
student privacy. Comments and suggestions can be sent to PrivacyTA@ed.gov. 


Introduction 


School officials routinely seek to balance the interests of safety and privacy for students. While the 
Family Educational Rights and Privacy Act (FERPA) generally requires written parent or “eligible 
student”! consent before an educational agency (district) or institution (school) discloses student 
education records and the personally identifiable information (PII) contained therein, FERPA gives 
schools and districts flexibility to disclose Pll, under certain limited circumstances, in order to maintain 
school safety. The purpose of this guidance is to address questions about how FERPA applies to schools’ 
and districts’ disclosures of PII from student education records to school security units, outside law 
enforcement entities, School Resource Officers (SROs), and other schools. While the information in this 
guidance is applicable to all educational agencies and institutions that receive funds under any program 
administered by the Secretary of the U.S. Department of Education (Department), the discussion is 
generally focused on health or safety emergencies faced by public elementary and secondary schools. 


Many schools and school districts have their own security units to monitor safety and security in and 
around school campuses. In FERPA, these entities are called “law enforcement units” if certain 
conditions are met. Some schools designate a particular school official or office to be responsible for 
referring potential or alleged violations of law to local law enforcement authorities. Other schools 
contract with off-duty police officers to provide school security, while still others utilize the services of 
an SRO, who serves as an on-site law enforcement officer and liaison with the local police or sheriffs 
department for reporting offenses and filing charges. Still others utilize a hybrid system combining one 
or more of the preceding methods. 


FERPA affords schools and districts flexibility when responding to circumstances that threaten the health 
or safety of individuals in their school community. Understanding the provisions of FERPA relative to 
such circumstances will empower school officials to act decisively and quickly when challenges arise. The 
following frequently asked questions detail how FERPA may apply in these circumstances. Although this 
guidance is focused on FERPA, there may be other federal and State laws, such as civil rights and privacy 


' When a student turns eighteen years of age, or enrolls in a postsecondary institution at any age, the student 
becomes an “eligible student” (34 CFR §99.3 “eligible student”) and all rights under FERPA transfer from the 
parent to the student. 34 CFR §99.5(a)(1) 
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laws, that are relevant to decision-making regarding when and with whom schools and districts may 
disclose, without appropriate consent, student information. At the federal level, for example, public 
elementary and secondary schools are subject to federal civil rights laws, including laws that prohibit 
discrimination based on: disability (the Americans with Disabilities Act (ADA) and Section 504 of the 
Rehabilitation Act of 1973); race, color, and national origin (Titles IV and VI of the Civil Right Act of 
1964); sex (Title IX of the Education Amendments of 1972); and religion (Title IV of the Civil Rights Act 
of 1964). Also, State educational agencies and local educational agencies must comply with the 
requirements of Part B of the Individuals with Disabilities Education Act (IDEA) in educating children 
with disabilities, including IDEA’s confidentiality of information requirements.? 


? See 20 U.S.C. 1417(c) and 34 CFR §§300.610-300.626. 
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education records of students who have been disciplined for conduct that posed a significant risk 
to the safety of the school community to officials at another SCHOOI? ........esesessecssseeseeseencseeseeseeneee 18 


Judicial Orders or Lawfully Issued SubpOena...............ssscssssrssssssssessscsecessssessssessseseceeessees 19 
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Q.32. May schools comply with a subpoena or court order for education records without the 
consent of the parent or eligible Student? oo... secsecssssseseesesecseesccuscussscseesssecscuccussussucaeeseseesescenseneaee 19 


Transfert NGw School Siessscciccccscccccccceccenseccesctecccsascsenssoaccaccssccecocstsscosstecceseocteessescosscessscesceees 19 


Q.33. Does FERPA permit schools to disclose any and all education records on a student to 
another school where the student seeks or intends to ENroll? ou... eesessecesseeseeseesesseseeseseeseeseeneeneeees 19 


Q.34. Are schools required to transfer certain student disciplinary records to other schools 
where the student seeks or intends to ENrolll? nn... sesecsssssseesesssecsecssesscessecsseeseeseesscussucseeesseeseessensenees 20 


Juvenile Justice System ............cccscscscssscscsecscccsccccccccccececescecesescscescscssscscscscsesccscccccccccccsceceseeees 20 


Q.35. Does FERPA permit the disclosure of PII from education records to officials of a State’s 


juvenile justice SYSteMM? ....... cs esececessseesececsecsccssessssesscsssscsecuecussusseesscacsecsecuscussussecseeseseescussussuesecaeseesceneeneenes® 20 
Release of Information Not Considered Education Records ...............ccccccccscsssssssscscscsccecsccees 21 
Personal Knowledge and Observation ............ccsccsssssscssssssccssssecssssecsssesssssssseesssssssessesees 21 


Q.36. Does FERPA permit school officials to release information that they personally observed 
or of which they have personal knowledge? ...........sssssssecssssssesseesecsesecssesseussesseesccucseenscusenssecsecsesecseescenseneeee 21 


Q.37. Are there any limitations to sharing information based on personal knowledge or 
IDS SN VACIOINS Pactececccsgnesbanvisevenvhaseayectecatecencectacetpeseica deaeaavscancaierctadtecinnied iene sieeementeeleaue aS 21 
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General Requirements of the Family Educational Rights and Privacy Act (FERPA) 
Applicable to this Guidance 


Q.1. 


Q.2. 


Q.3. 


Do any laws other than FERPA address the disclosure of personally identifiable 
information (PII) from students’ education records or other disclosures of 
information on students? 


Yes. As noted in the “Introduction” section, there may be other federal and State laws, as well 
as local policies that address information sharing on students, including laws concerning the civil 
rights of students.3 In addition, the education records of students who are children with 
disabilities are not only protected by FERPA but also by the confidentiality of information 
provisions in the Individuals with Disabilities Education Act (IDEA).4 (See Q.5) Among other 
laws, student records may, under some circumstances, also be covered by the provisions of the 
Health Insurance Portability and Accountability Act of 1996 (HIPAA) or the Richard B. Russell 
National School Lunch Act.5 


What is FERPA and to which entities does it apply? 


FERPA is a federal law that protects the privacy of student education records, and the PIl 
contained therein, maintained by educational agencies or institutions or by a party acting for the 
agencies or institutions. The FERPA statute is found at 20 U.S.C. § 1232g and its implementing 
regulations are set forth at 34 CFR Part 99. FERPA applies to all educational agencies and 
institutions that receive funds under any program administered by the Secretary of the U.S. 
Department of Education (Department).6 The term “educational agencies and institutions” 
generally refers to local educational agencies (LEAs), elementary and secondary schools, and 
postsecondary institutions. Private schools at the elementary and secondary levels generally do 
not receive funds from the Department and are, therefore, not subject to FERPA, but may be 
subject to other data privacy laws such as HIPAA. In this guidance, when we refer to LEAs, 
school districts, or schools, we mean “educational agencies and institutions,” as applicable, 
subject to FERPA. A copy of the regulations may be found on our website at: 
https://studentprivacy.ed.gov/ 


To whom does the information in this guidance apply? 


The information in this guidance applies to all educational agencies and institutions. That said, 
the guidance generally focuses on addressing health or safety emergency situations faced by the 
elementary and secondary school community. For additional information on FERPA’s application 
to health or safety emergency situations in the postsecondary institution context, please refer to 


3 Many State laws provide greater privacy protections than FERPA does, however FERPA establishes a minimum 
federal standard governing the privacy of education records and the Pll contained therein. 

* For additional information on the interaction of FERPA and IDEA confidentiality provisions, please refer to 
previously issued Department guidance entitled, “IDEA and FERPA Confidentiality Provisions,” issued in June 2014, 
available at: https://studentprivacy.ed.gov/resources/ferpaidea-cross-walk. 

° For information relating to the interaction of FERPA and HIPAA with respect to student health records, please 
refer to the “Joint Guidance on the Application of the Family Educational Rights and Privacy Act (FERPA) And the 
Health Insurance Portability and Accountability Act of 1996 (HIPAA) To Student Health Records” issued by the 
U.S. Department of Education and the U.S. Department of Health and Human Services in November 2008, 
available at: https://studentprivacy.ed.gov/resources/joint-guidance-application-ferpa-and-hipaa-student-health- 


records 


° 34 CFR § 99.1 
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previously issued Department guidance entitled, “Addressing Emergencies on Campus,” issued 
in June 2011, available at: https://studentprivacy.ed.gov/resources/addressing-emergencies- 
campus. Additionally, the Department has released several guides for developing emergency 
operations plans for elementary and secondary schools, school districts, and postsecondary 
institutions. These guides may be found at: https://rems.ed.gov/Resource_Plan_Basic_EOP.aspx. 


What are the rights of parents and students under FERPA? 


FERPA affords parents certain rights with respect to their children’s education records 
maintained by schools and school districts to which FERPA applies. These include the right to 
inspect and review their children’s education records, the right to seek to have the education 
records amended, and the right to have some control over the disclosure of Pll contained in the 
education records.” These rights transfer to the student when he or she reaches the age of |8 
years or attends a postsecondary institution at any age (and thereby becomes an “eligible 
student” under FERPA).® 


What are “education records’’? 


The term “education records” is defined, with certain exceptions, as those records that are: (I) 
directly related to a student; and (2) maintained by an educational agency or institution, or by a 
party acting for the agency or institution.? Records on children with disabilities who receive 
evaluations, services, or other benefits under Part B of the IDEA are subject to IDEA’s 
“Confidentiality of Information” requirements, in addition to being considered “education 
records” subject to FERPA. !° 


Are there any types of records or documents that are specifically excluded from the 
definition of ‘“‘education records’”’ under FERPA? 


Yes. There are several categories of records that may be maintained by an educational agency or 
institution that are not “education records” under FERPA.'! One such category of records — 
records of a “law enforcement unit” — is particularly relevant to school safety and is discussed in 
detail in Qs 18 and 19, below. 


What is “directory information” and is it protected by FERPA? 


FERPA defines “directory information” as information contained in a student’s education record 
that would not generally be considered harmful or an invasion of privacy if disclosed.!2 Directory 
information may include, but is not limited to, the student’s name; address; telephone listing; 
electronic mail address; photograph; date and place of birth; major field of study; grade level; 
dates of attendance; participation in officially recognized activities and sports; weight and height 


720 U.S.C. §§ 1232g(a)(1) and (2), (b), (h), (i), and (j); 34 CFR Part 99, Subparts B, C, and D. 

° 34 CFR §§ 99.3, “Eligible student,” and 99.5 

? 34 CFR § 99.3, “Education records.” 

'° 34 CFR §§ 300.610 — 300.626 

'' Please refer to the definition of “education records” set forth in FERPA at 20 U.S.C. § 1232g(a)(4) and the 
implementing regulations at 34 CFR § 99.3 for further information on the types of records that are not considered 
“education records.” 

'2 34 CFR § 99.3, “Directory information.” 
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of members of athletic teams; degrees, honors, and awards received; and the most recent 
educational agency or institution attended.!3 


The disclosure of appropriately designated directory information, under certain specified 
conditions, is one of the exceptions to FERPA’s general written consent requirement.'4 A school 
or district may disclose directory information, without the parent or eligible student’s written 
consent, to third parties, including law enforcement officials, if it has given public notice to 
parents and eligible students of (1) the types of Pll that it has designated as “directory 
information,” (2) the right of the parent or eligible student to restrict the disclosure of such 
information, and (3) the period of time within which a parent or eligible student has to notify 
the educational agency or institution in writing that he or she does not want any or all of those 
types of information designated as “directory information.”!5 In addition, a school or district may 
implement a limited directory information policy by specifying in its public notice to parents and 
eligible students that its disclosure of appropriately designated directory information will be 
limited to specific parties (and not others), for specific purposes, or both.!é 


What is “personally identifiable information” under FERPA? 


Personally identifiable information (PII) is defined to include not only direct identifiers like the 
student’s name and Social Security number, but also indirect identifiers such as the student’s 
date and place of birth and the mother’s maiden name.!7 Pll also includes “[o]ther information 
that, alone or in combination, is linked or linkable to a specific student that would allow a 
reasonable person in the school community, who does not have personal knowledge of the 
relevant circumstances, to identify the student with reasonable certainty.”!® That is, in some 
cases, a record may not contain a direct or even an indirect identifier, but would still contain PIl 
under FERPA. For example, when an event at a school generates significant publicity, otherwise 
permissible non-consensual disclosures of redacted education records may no longer be 
permissible under FERPA because the publicity would allow a reasonable person in the school 
community to identify with reasonable certainty the student(s) involved. Pll also includes any 
information requested by a person who the educational agency or institution reasonably believes 
knows the identity of the student to whom the education records relates. 


Who must provide consent for the disclosure of PII from a student’s education 
records? 


In general, with certain exceptions, before an educational agency or institution discloses Pll from 
a student’s education record, the student’s parent or the eligible student must provide a signed 
and dated written consent. That consent must specify the education records (or the Pll 
contained in those records) that may be disclosed, must state the purposes of the disclosure, 
and must identify the party or class of parties to whom the disclosure may be made.!? 


3 Id; 20 U.S.C. § 1232g(a)(5)(A). 

* 34 CFR §§ 99.31 (a)(I1) and 99.37 

> 34 CFR § 99.37(a) 

° 34 CFR § 99.37(d) 

” 34 CFR § 99.3, “Personally Identifiable Information.” 


° 34 CFR § 99.30 
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Are there exceptions to FERPA’s general written consent requirement that permit 
schools and districts to disclose PII from education records without consent? 


Yes. While FERPA generally requires parents or eligible students to provide a school or district 
with written consent before the school or district discloses Pll from a student’s education 
records, there are a number of exceptions to this prior written consent requirement.2° For 
example, assuming that certain conditions are satisfied, FERPA permits a school or district to 
disclose education records under the “health or safety emergency” exception without obtaining 
prior written consent.?! Several of these exceptions to the consent requirement that are most 
relevant in the school safety context are discussed below. Additionally, as explained more fully 
in Q.19 below, because “law enforcement unit records” are not “education records,” they, 
therefore, may be disclosed, without the parent or eligible student’s consent, to outside parties 
under FERPA. Similarly, while IDEA generally also requires prior written consent from the 
parent (or from a student who has reached the age of majority under State law, if parental rights 
have transferred to the student) for disclosure of Pll from education records, IDEA generally 
incorporates the FERPA exceptions to the prior consent requirement.22 


Are schools and districts required to record the disclosure of PII from students’ 
education records whenever they make disclosures? 


Subject to certain exceptions addressed below, schools and districts must maintain a record of 
each request for access to and each disclosure of Pll from the education records of each 
student, as well as the names of State and local educational authorities and federal officials and 
agencies listed in 34 CFR § 99.31(a)(3) that may make further disclosures of Pll from the 
student’s education records without consent.23 The school or district must maintain the record 
of disclosure with the education records of the student as long as the education records are 
maintained.24 


For each request or disclosure, the record of disclosure must include: (I) the parties who have 
requested or received PIl from the education records; and (2) the legitimate interests the 
parties had in requesting or obtaining the information (i.e., under which exception to FERPA’s 
general written consent requirement the disclosure was made).2> As explained in the answer to 
Q.30 below, the school or district must record additional information whenever it discloses, 
without appropriate consent, Pll from a student’s education records under FERPA’s health or 
safety emergency exception.26 There are additional requirements that relate to recording 
further disclosures made by State and local authorities and federal officials and agencies listed 
under 34 CFR § 99.31 (a)(3) with which schools and districts should also be familiar.2” 


Schools and districts do not have to record requests for Pll from education records from, or 
disclosures of Pll from education records that were made to: (1) the parent or eligible student; 
(2) a school official under 34 CFR § 99.31 (a)(1); (3) a party with written consent from the 


2 20 US.C. §§ 1232g(b)(1), (b)(2), (b)(3), (b)(5), (b)(6), (h), (i), and (j); 34 CFR § 99.31 
2! 20 U.S.C. § 1232g(b)(1)(I); 34 CFR §§ 99.31 (a)(10) and 99.36 

22 34 CFR § 300.622 

23 20 US.C. § 1232g(b)(4)(A); 34 CFR § 99.32(a)(1) 

4 34 CFR § 99.32(a)(2) 

5 34 CFR § 99.32(a)(3). 

26 34 CFR § 99.32(a)(5) 

7 34 CFR §§ 99.32(a)(4) and (b)(2) 
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parent or eligible student; (4) a party seeking directory information; or (5) a party seeking or 
receiving records in accordance with the provisions in FERPA related to non-consensual 
disclosures pursuant to certain types of lawfully issued subpoenas or court orders.28 However, 
in the interests of promoting greater transparency, the Department considers it a best practice 
for schools and districts to voluntarily record such disclosures in certain situations, such as 
when records are produced pursuant to certain lawfully issued subpoenas or court orders. 


Disclosures of PII from Students’ Education Records Without Written Consent 
General 


Q.12. When are schools or districts required by FERPA to disclose PII from a student’s 
education records? 


FERPA does not contain any provisions that require schools or districts to “disclose” Pll from a 
student’s education records. The disclosures discussed in this guidance document describe the 
conditions under which a school or district may disclose education records without the parent 
or eligible student’s consent. That said, FERPA does require schools and districts as well as state 
educational agencies (SEA) and their components to provide parents and eligible students with 
the opportunity to “inspect and review” the student’s own education records.29 Further, if 
circumstances effectively prevent the parent or eligible student from exercising this right to 
inspect and review, the educational agency or institution, or SEA or its components, must 
provide the parent or eligible student with a copy of the education record requested or make 
other arrangements for the parent or eligible student to inspect and review the education 
record.30 


School Officials 


Q.13. Who qualifies as a “school official” under FERPA, and to whom may schools and 
districts disclose education records under the school official exception to FERPA’s 
general written consent requirement? 


FERPA permits schools and districts to disclose education records (and the PII contained in 
those records) without appropriate consent, to “school officials” provided that the school or 
district has determined that these school officials have “legitimate educational interests” in the 
education records.3! Under FERPA, a school or district must include in its annual notification of 
FERPA rights the specific criteria they use for determining who constitutes a “school official” 
and what constitutes a “legitimate educational interest.”32:3334 A “school official” may include, 


28 34 CFR §§ 99.31 (a)(9)(ii)(A)-(C); 34 CFR § 99.32(d) 

? 20 U.S.C. § 1232g(a)(1)(A) and (B); 34 CFR § 99.10(a) 

3° 34 CFR § 99.10(d) 

3! 20 U.S.C. § 1232g(b)(1)(A); 34 CFR § 99.31 (a)(1)(i)(A). 

32 34 CFR § 99.7(a)(3)(iii) 

3 The Department has created a “Model Notification of Rights under FERPA for Elementary and Secondary 
Schools,” available at: https://studentprivacy.ed.gov/resources/ferpa-model-notification-rights-elementary- 
secondary-schools 

* This notification must be distributed by a school or district every year through a means that is likely to be 
viewed by parents and eligible students, such as a student handbook, school website, or a direct letter to parents, 
and must inform parents and eligible students of their rights under FERPA. 
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but is not limited to, a teacher, school principal, president, chancellor, board member, trustee, 
registrar, counselor, admissions officer, attorney, accountant, human resources professional, 
information systems specialist, and support or clerical personnel. 


Contractors, consultants, volunteers, or other third parties to whom a school or district has 
outsourced certain functions may be also be considered “school officials.”35 Schools and districts 
may disclose education records (and the PII contained in those records), without appropriate 
consent to such school officials provided that they (1) perform an institutional service or 
function for which the school or district would otherwise use employees; (2) are under the 
“direct control” of the school or district with respect to the use and maintenance of the 
education records; (3) are subject to FERPA’s use and re-disclosure requirements set forth in 34 
CFR § 99.33(a); and (4) satisfy the criteria specified in the school or district’s annual notification 
of FERPA rights for being “school officials” with “legitimate educational interests” in the 
education records.3é 


Typically, a school official would have a “legitimate educational interest” if he or she needs to 
review an education record in order to fulfill his or her professional responsibilities. Please note 
that schools and districts must use reasonable methods to ensure that school officials obtain 
access to only those education records in which they have legitimate educational interests.37 If a 
school or district does not use physical or technological access controls, it must ensure that its 
administrative policy for controlling access to education records is effective and that it remains 
in compliance with FERPA’s legitimate educational interest requirement.38 


Can law enforcement unit officials who are school employees be considered school 
officials with legitimate educational interests? 


Yes, if certain conditions apply. A law enforcement unit official who is an employee of a school 
or district generally would be considered a school official to whom the school or district may 
disclose, without consent, education records (or PII contained in those records), if the law 
enforcement unit official meets the criteria specified in the school or district’s annual notification 
of FERPA rights to parents and eligible students for being a “school official” with a “legitimate 
educational interest” in the education records. In several questions below we discuss how the 
school official exception to FERPA’s general written consent requirement applies in situations in 
which the law enforcement unit is not comprised of school employees. 


Can law enforcement unit officials who are off-duty police officers or SROs be 
considered school officials under FERPA and, therefore, have access to students’ 
education records? 


Yes, if certain conditions are met. Under FERPA, schools and districts may consider law 
enforcement unit officials, such as off-duty police officers and SROs, to be “school officials” if the 
school or district has outsourced the function of providing safety and security for the school or 


35 34 CFR § 99.31 (a)(1)(i)(B) 
36 34 CFR § 99.31 (a)(1)(i) 
37 34 CFR § 99.31 (a)(1)(ii) 


38 Ibid 


PTAC-FAQ-11, February 2019 11 


A Sra x & 1A 


district to the law enforcement unit officials.39 Law enforcement unit officials could qualify as “school 
officials’ under FERPA if they: 


|. Perform an institutional service or function for which the school or district would otherwise use 
employees (e.g., to ensure school safety); 


2. Are under the “direct control” of the school or district with respect to the use and 
maintenance of the education records (e.g., through a memorandum of understanding (MOU) 
that establishes data use restrictions and data protection requirements); 


3. Are subject to FERPA’s use and re-disclosure requirements in 34 CFR § 99.33(a), which 
provides that the PIl from education records may be used only for the purposes for which the 
disclosure was made (e.g., to promote school safety and the physical security of students), and 
which limits the re-disclosure of Pll from education records; and 


4. Meet the criteria specified in the school or district’s annual notification of FERPA rights for being 
school officials with legitimate educational interests in the education records.*° 


The best practice to ensure compliance with these provisions is for the school and the law 
enforcement unit to enter into a MOU that specifically addresses these issues.?! 


As indicated in the listing above, off-duty police officers and SROs who qualify as “school officials” 
may only use PII from education records for the purposes for which the disclosure was made, e.g., 
to promote school safety and the physical security of the students.*2 In addition, these officers are 
subject to FERPA’s re-disclosure requirements in 34 CFR § 99.33(a). This means that an off-duty 
police officer or SRO who is acting as a “school official” under FERPA may not re-disclose, without 
appropriate consent, Pll from education records to outside parties, including other employees of his 
or her police department who are not acting as school officials, unless the disclosure satisfies an 
exception to FERPA’s general written consent requirement, as further discussed below (e.g., if the 
re-disclosure is made pursuant to a lawfully issued subpoena or court order*3 or to appropriate 
parties under the health and safety emergency exception). 


Threat Assessment Teams 


Q.16. What is a threat assessment team? 


A threat assessment team is a group of individuals who convene to identify, evaluate, and 
address threats or potential threats to school security. Threat assessment teams review 
incidents of threatening behavior by students (current and former), parents, school employees, 
or other individuals, and, based on the information received, relying on their collective 
expertise, provide guidance to school officials on how to respond to the potential threat. These 


3? 34 CFR § 99.31 (a)(1)(i)(B)(1)-(3), 

“9 34 CFR § 99.31 (a)(1)(i) 

*' For additional information about memoranda of understanding, see the Final Report of the Federal Commission 
on School Safety (2018), Chapter 13, “Training School Personnel to Help Ensure Student Safety” available at 
https://www2.ed.gov/documents/school-safety/school-safety-report.pdf 

34 CFR §§ 99.31 (a)(1)(i)(B)(3) and 99.33(a)(2) 

*® Subject to certain exceptions, FERPA requires the disclosing entity to make a reasonable effort to notify the 
parent or eligible student in advance of compliance with the subpoena or order. 34 CFR § 99.31 (a)(9)(ii) 
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expertise, provide guidance to school officials on how to respond to the potential threat. These 
teams are more common in university settings but are also being instituted in elementary and 
secondary schools. 


Some schools may need assistance in determining whether a health or safety emergency exists 
in order to know whether a disclosure to appropriate parties (e.g., emergency responders or 
law enforcement) may be made under FERPA’s health or safety emergency exception. 
Accordingly, members of a threat assessment team include individuals who can assist in making 
such decisions, such as school principals, counselors, educators, and school law enforcement 
unit officials, as well as outside medical and mental health professionals and local law 
enforcement officers. 


In July 2004, the Department and the U.S. Secret Service jointly issued a booklet entitled, 
“Threat Assessment in Schools: A Guide to Managing Threatening Situations and to Creating 
Safe School Climates,” which includes guidance on the formation of threat assessment teams on 
pages 37-38. Information on establishing a threat assessment program, including a link to this 
booklet and other helpful resources for emergency situations, can be found on the 
Department’s website at: http://www.ed.gov/admins/lead/safety/edpicks.jhtml. 


For additional information on threat assessment teams, please also refer to joint guidance issued 
in 2013 by the Department and several federal agencies entitled, “Guide for Developing High- 
Quality School Emergency Operations Plans,” available at: http://rems.ed.gov/docs/REMS_K- 
12_Guide_508.pdf. 


Q.17. Does FERPA permit schools and districts to disclose education records, without 
consent, to outside law enforcement officials, mental health officials, and other 
experts in the community who serve on a school’s threat assessment team? 


Yes, if certain conditions are met. The Department has long encouraged schools and districts to 
implement a threat assessment program that relies on teams, composed of a wide variety of 
individuals, to gather information, evaluate facts, and determine whether a health or safety 
emergency exists.44 The members of the threat assessment team should meet the criteria for 
constituting school officials under FERPA, so that they may assist the institution in gathering 
information (including Pll from education records), evaluating facts, and making institutional 
determinations, such as whether a health or safety emergency exists, and how the school or 
district should respond. Under FERPA, a school or district may disclose Pll from education 
records, without appropriate consent, to threat assessment team members who are not 
employees of the school or district to determine whether there is a health of safety emergency 
if they: 


|. Perform an institutional service or function for which the school or district would otherwise 
use employees; 


2. Are under the “direct control” of the school or district with respect to the use and 
maintenance of the education records; 


“ “Threat Assessment in Schools: A Guide to Managing Threatening Situations and to Creating Safe School 
Climates,” pages 37-38. http://www.ed.gov/admins/lead/safety/edpicks.jhtml. 
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3. Are subject to FERPA’s use and re-disclosure requirements in 34 CFR § 99.33(a), which 
provide that the Pll from education records may be used only for the purposes for which 
the disclosure was made, and which limits the re-disclosure of PIl from education records; 
and 


4. Qualify as “school officials” with “legitimate educational interests.” See Q.14 for more 
information. 


While not a requirement of FERPA, one way to ensure that members of the team are aware of 
the FERPA requirements related to the use and re-disclosure of PII obtained from education 
records is to require members of the threat assessment team to sign an acknowledgement of 
their responsibilities for safeguarding student information under FERPA. 


Schools and districts are reminded that members of a threat assessment team may only use PIl 
from education records for the purposes for which the disclosure was made, i.e., to conduct 
threat assessments, and are subject to FERPA’s re-disclosure requirements in 34 CFR § 99.33(a). 
For example, a representative from the city police who serves on a school’s threat assessment 
team generally could not give the police department any Pll from a student’s education records 
to which he or she was privy as a member of the team, unless the disclosure meets an 

exception to consent, such as a disclosure in connection with a health or safety emergency, and 
any applicable recordation requirements in FERPA are met. While school officials must make the 
ultimate determination as to whether information about a threat is sufficiently significant and 
articulable to warrant disclosure without consent to appropriate parties under the health and 
safety emergency exception, schools and districts may, at their discretion, grant non-employees 
serving as school officials on the threat assessment team the ability to make this determination 
on their behalf.45 See Q25-26 for more information on the health and safety emergency 
exception to consent. 


Law Enforcement Unit & Law Enforcement Unit Records 


Q.18. What is a “law enforcement unit’”? 


Under FERPA, “law enforcement unit” means any individual, office, department, division, or 
other component of a school or district, such as a unit of police officers or security guards, that 
is officially authorized or designated by that school or district to (1) enforce any local, State, or 
federal law, or refer to appropriate authorities a matter for enforcement of any local, State, or 
federal law, against any individual or organization other than the agency or institution itself; or 
(2) maintain the physical security and safety of the agency or institution.*6 


Schools vary in who is authorized or designated to be their law enforcement unit, usually 
depending upon school size and resources. Some larger school districts have their own fully 
equipped police units, while others have smaller security offices. Other schools designate a vice 
principal or other school official to act as the law enforcement unit officer. Other schools may — 
as discussed in Qs 21-24 — use non-school employees such as local police officers and SROs as 
their designated law enforcement unit officers. 


45 34 CFR §§ 99.31(a)(10) and 99.36 
46 34 CFR § 99.8(a)(I) 
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What is a law enforcement unit record? 


Law enforcement unit records are records that are: (1) created by a law enforcement unit; (2) 
created for a law enforcement purpose; and (3) maintained by the law enforcement unit.4”7 Law 
enforcement unit records are not protected by FERPA because they are specifically excluded 
from the definition of “education records” and, thus, from the privacy protections afforded to 
parents and eligible students by FERPA.*8 Therefore, investigative reports and other records 
created and maintained by law enforcement units that meet this definition are not considered 
“education records” subject to FERPA and may be released subject to school policy, State law, 
and other applicable laws. 


When members of a school’s law enforcement unit are school officials with access to students’ 
education records (or to PIl contained in those records), they may not re-disclose the records 
or Pll they receive as school officials under FERPA without appropriate consent or except as 
permitted under FERPA (see Q.20), such as if the re-disclosure is to other school officials, or 
under the health and safety emergency exception. It is, therefore, advisable for law enforcement 
units to maintain law enforcement unit records separately from education records. 


When can law enforcement unit officials serve as “school officials?” 


In order for law enforcement unit officials to be considered school officials, they must meet the 
criteria for who constitutes a school official that are set forth in the school or district’s annual 
notification to parents and eligible students of their rights under FERPA and preferably defined in 
an MOU for non-school employees.*? As explained in Qs 13-15, schools and districts must also 
determine that the school official’s interest in accessing the education records meets the criteria 
for legitimate educational interests, as set forth in the school’s or district’s annual notification of 
FERPA rights. A school official typically would have a “legitimate educational interest” if the 
official needs to review an education record in order to fulfill his or her professional or 
delegated responsibility. 


Having law enforcement unit officials who are “school officials” with “legitimate educational 
interests” will permit a school to disclose Pll from students’ education records, without 
appropriate consent, to its law enforcement unit officials so that they may perform their 
professional duties and assist with school safety matters. For example, if a student is expelled 
from school and barred from campus the principal could disclose the student’s disciplinary 
report to law enforcement unit officials so that they would know that the student should not be 
on campus. The Pll from the student’s education records that is provided to the school’s law 
enforcement unit officials remains subject to FERPA and may only be further disclosed by that 
unit (e.g., to the local police department) with consent or as otherwise permitted under 
FERPA®°, such as making a disclosure to comply with a lawfully issued subpoena®! or the 


“7 34 CFR § 99.8(b)(1) 

“8 34 CFR § 99.3, “Education Records” 

“? 34 CFR § 99.7(a)(3)(iii) 

°° 34 CFR § 99.33. To be permissible under FERPA, any such redisclosures must be on behalf of the educational 
agency or institution, and must meet the requirements of one or more of the exceptions to consent at 34 CFR 


99.31. 


5! 34 CFR § 99.31 (a)(9) 
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disclosure is in connection with a health or safety emergency,52 and provided FERPA’s 
recordkeeping requirements have been met.*3 


Utilizing Local Police Officers and SROs as School Law Enforcement Unit Officials 


Q.21. 


Q.22. 


Q.23. 


Q.24. 


Does a school or district have to use only employees to staff its law enforcement 
unit? 


No. The manner in which a school or district staffs its law enforcement unit is not addressed by 
FERPA. Accordingly, FERPA does not require a school or district to use only employees to staff 
its law enforcement unit and may contract out those services. 


Are SROs or other outside local law enforcement officials who serve as a school’s 
law enforcement unit automatically considered school officials? 


Not automatically. Subject to the conditions indicated in Q.15 relative to outsourcing 
institutional services or functions, these officials may be considered “school officials” with 
“legitimate educational interests” and may have access to students’ education records. 


Can a school provide local or other law enforcement officials with “directory 
information” on students? 


Yes. If the school or district has a directory information policy under FERPA that permits this 
disclosure to local or other law enforcement officials, then the directory information of those 
students whose parents (or those eligible students who) have not opted out of such a disclosure 
may be disclosed without appropriate consent.*4 See the related discussion in Q.7. 


Does FERPA distinguish between SROs and other local police officers who work in a 
school? 


No. As noted previously, an SRO typically serves as an on-site law enforcement officer and as a 
liaison with the local police or sheriffs department. An SRO may be designated by a school or 
district as a “law enforcement unit” official under FERPA.55 However, in order for a school or 
district to disclose education records (or any PII contained in those records) to an SRO, 
without appropriate consent, the disclosure must satisfy an exception to FERPA’s general 
written consent requirement such as the “school official” exception under which the SRO must 
be considered a “school official” with a “legitimate educational interest” under FERPA. See Qs 
15 and 22. 


As explained in Q.15, the school or district must have direct control over an SRO’s 
maintenance and use of education records in providing SRO services in order for the SRO to be 
considered a school official. Additionally, as explained in Q.13, schools and districts must use 
reasonable methods to ensure that school officials obtain access to only those education 
records in which they have legitimate educational interests. Further, under the school official 
exception (as well as any FERPA exception to consent), SROs may only use the Pll from 


52 34 CFR §§ 99.31(a)(10) and 99.36 
53 34 CFR § 99.32 

54 34 CFR §§ 99.31(a)(I1) and 99.37 
55 34 CFR § 99.8(a)(I) 


PTAC-FAQ-11, February 2019 16 


COD Bah 1A 


education records for the purposes for which the disclosure was made, e.g., to promote school 
safety and the physical security of the students.>¢ In addition, SROs are subject to FERPA’s re- 
disclosure limitations.5”? This means that an SRO who is serving as a “school official” under 
FERPA may not disclose Pll from education records to others, including other employees of his 
or her local police department who are not acting as school officials, without consent unless: 
(1) the re-disclosure is on behalf of the educational agency or institution; (2) the re-disclosure 
fits within one of the exceptions to FERPA’s consent requirement (see Qs |5 and 17); and (3) 
the recordkeeping requirements in 34 CFR § 99.32 have been met. 


Other Exceptions to FERPA’s General Consent Rule Relevant to School Safety 


Health or Safety Emergencies 


Q.25. 


Q.26. 


When is it permissible for schools or districts to disclose, without appropriate 
consent, student education records (or PII contained in those records) under 
FERPA’s health or safety emergency exception? 


In some situations, school administrators may determine that it is necessary to disclose a 
student’s education records (or PIl contained in those records) to appropriate parties in order 
to address a specific and articulable threat of a health or safety emergency. FERPA’s health or 
safety emergency provision permits such disclosures when the disclosure is necessary to protect 
the health or safety of the student or other individuals.°8 This exception to FERPA’s general 
consent requirement is limited to the period of the emergency and does not allow for a blanket 
release of Pll from a student’s education records. Rather, these disclosures must be related to a 
significant and articulable emergency, such as an impending natural disaster, a terrorist attack, a 
campus threat, or the outbreak of an epidemic disease. Please refer to the following previously 
issued Department guidance entitled, “Addressing Emergencies on Campus,” issued in June 
2011, for additional information: https://studentprivacy.ed.gov/resources/addressing- 
emergencies-campus. 


Who are considered “appropriate parties” that may receive information under the 
health or safety emergency exception? 


An appropriate party under the health or safety emergency exception to FERPA’s general 
consent requirements is a party whose knowledge of such information is necessary to protect 
the health or safety of the student or other persons. Typically, local or State law enforcement 
officials, public health officials, trained medical personnel, and parents (including parents of an 
eligible student) are the types of appropriate parties to whom schools and districts may disclose 
information under this FERPA exception.5? 


°6 34 CFR §§ 99.31 (a)(1)(i)(B)(3) and 99.33(a)(2). 

°” 34 CFR § 99.33(a) 

°° 34 CFR §§ 99.31 (a)(10) and 99.36 

*? Please refer to the following previously issued Department guidance entitled, “Addressing Emergencies on 
Campus,” issued in June 2011, for additional information: https://studentprivacy.ed.gov/resources/addressing- 
emergencies-campus 
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How does a school or district know when a health or safety emergency exists so 
that a disclosure may be made under this exception to consent? 


A school or district must make this determination on a case-by-case basis, taking into account 
the totality of the circumstances pertaining to a threat to the health or safety of a student or 
others. If the school or district determines that there is an articulable and significant threat to 
the health or safety of a student or other individuals and that one or more third parties (e.g., law 
enforcement officials, public health officials, trained medical personnel, parents, etc.) need 
education records (or Pll contained in those records) in order to protect the health or safety of 
the student or other individuals, it may disclose that information to the appropriate parties 
without consent. 


What does “articulable and significant threat” mean? 


This is a flexible standard under which the Department generally defers to school officials so 
that they might respond appropriately. In applying this standard, a school official should be able 
to explain the basis for his or her reasonable belief, based on all the available information, as to 
why a given student poses an “articulable and significant threat.” The phrase “articulable and 
significant threat” means that a school official is able to explain, based on all the information 
available at the time, what the threat is and why it is significant when he or she makes and 
records the disclosure.®! 


May a school make disclosures under FERPA’s health or safety emergency 
exception for emergency preparedness exercises? 


No. Disclosures made under the health or safety emergency exception must be “in connection 
with an emergency,” which means it must be related to an actual, impending, or imminent 
emergency, such as a natural disaster, a terrorist attack, a campus threat, or the outbreak of an 
epidemic disease. 


Does a school have to record disclosures made under FERPA’s health or safety 
emergency exception? 


Yes. When a school or district makes a disclosure under the health or safety exception, it must 
record in the student’s education records the articulable and significant threat that formed the 
basis for the disclosure, and the parties to whom the information was disclosed.6? (The 
recordkeeping requirements for disclosures under the health or safety emergency exception are 
different than the recordkeeping requirements for other disclosures discussed in Q.1 1.) 


Are there other situations in which school officials may non-consensually disclose 
PIl from education records of students who have been disciplined for conduct that 
posed a significant risk to the safety of the school community to officials at another 
school? 


Yes. Under FERPA, a school or district may disclose appropriate information concerning 
disciplinary action taken against a student who has been disciplined for conduct that posed a 
significant risk to the safety or well-being of that student, other students, or other members of 


69 34 CFR § 99.36(c). 
‘| 34 CFR § 99.36 
©2 34 CFR § 99.32(a)(5) 
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the school community, to school officials at another school. The school must determine that the 
other school has a legitimate educational interest in the behavior of the student.® 


For instance, a school official knows that a student, who had recently been disciplined for 
bringing a weapon to school, was overheard threatening to hurt students or teachers at a 
school-sponsored activity at another school. In this instance, FERPA would allow that school 
official to notify school officials at the other school who have been determined to have 
legitimate educational interests in the behavior of the student.* Please note that this exception 
does not permit the non-consensual disclosure of information concerning disciplinary action 
taken against a student for behavior that did not pose a significant risk to the safety or well- 
being of that student, other students, or other members of the school community (see Q.28). 


Judicial Orders or Lawfully Issued Subpoenas 


Q.32. May schools comply with a subpoena or court order for education records without 
the consent of the parent or eligible student? 


Yes, although a reasonable effort to notify the parent or eligible student is generally required. 
FERPA permits disclosure of education records without consent in compliance with a lawfully 
issued subpoena or judicial order.65 However, a school or district must generally make a 
reasonable effort to notify the parent or eligible student of the subpoena or judicial order 
before complying with it in order to allow the parent or eligible student the opportunity to seek 
protective action, unless certain exceptions apply. Exceptions to the requirement of making a 
reasonable effort to provide prior notification apply to: (1) a federal grand jury subpoena or 
other subpoena issued for a law enforcement purpose if the court or other issuing agency, for 
good cause shown, has ordered that the existence or the contents of the subpoena or the 
information furnished in response to the subpoena not be disclosed; and (2) an ex parte order 
obtained by the United States Attorney General (or designee not lower than Assistant Attorney 
General) concerning investigations or prosecutions of an act of terrorism or other specified 
offenses.6¢ For example, if a school received a law enforcement subpoena that requested PIl 
about a student suspected of selling drugs, it would not have to make an effort to notify the 
parent or eligible student if the court or other issuing agency, for good cause shown, had 
ordered that the existence or the contents of the subpoena or information furnished in 
response to the subpoena not be disclosed. 


Transfer to New Schools 


Q.33. Does FERPA permit schools to disclose any and all education records on a student 
to another school where the student seeks or intends to enroll? 


Yes. FERPA permits a school or district to disclose education records (or Pll contained in those 
records) without appropriate consent to another school or school system in which a student 


$3 34 CFR § 99.36(b)(3) 
“4 34 CFR § 99.36(b)(3). 
$20 US.C. § 1232g(b)(2)(B); 34 CFR § 99.31 (a)(9)(i) and (ii) 
6 20 US.C. §§ 1232g(b)(1)(J) and (j); 34 CFR § 99.31(a)(9)(ii) 
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seeks or intends to enroll, subject to certain conditions.*” This exception to FERPA’s general 
consent requirement also permits a school to disclose education records when a student is 
being placed in a juvenile justice facility that is considered a school. 


Are schools required to transfer certain student disciplinary records to other 
schools where the student seeks or intends to enroll? 


It depends on State procedures. A State receiving funds under the Elementary and Secondary 
Education Act of 1965, as amended (ESEA),¢8 was required, not later than January 8, 2004, to 
provide an assurance to the Secretary that they had “a procedure in place to facilitate the 
transfer of disciplinary records, with respect to a suspension or expulsion, by local educational 
agencies to any private or public elementary school or secondary school for any student who is 
enrolled or seeks, intends, or is instructed to enroll, on a full- or part-time basis, in the school.” 
Schools and districts, therefore, should include a notice in their annual notification of rights 
under FERPA that they forward such student disciplinary records with respect to a suspension 
or expulsion by local educational agencies to other elementary or secondary schools that have 
requested the records and in which the student seeks or intends to enroll.¢® Unless the school 
or district includes this notice in its annual notification of FERPA rights or the parent or eligible 
student initiates the transfer of records, the school or district otherwise would be required to 
make a reasonable effort to notify the parent or eligible student of the disclosure at the last 
known address of the parent or eligible student.7° (See the model notification of rights: 
https://studentprivacy.ed.gov/resources/ferpa-model-notification-rights-elementary-secondary- 
schools 


Juvenile Justice System 


Q.35. 


Does FERPA permit the disclosure of PII from education records to officials of a 
State’s juvenile justice system? 


Yes, under certain conditions. FERPA permits schools to non-consensually disclose education 
records and the PIl contained therein to State and local officials or other authorities if the 
disclosure is specifically: (1) allowed to be reported or disclosed by a State law adopted prior 
to November 19, 1974, if the allowed reporting concerns the juvenile justice system and the 
system’s ability to effectively serve the student whose records are released; or (2) allowed to be 
reported or disclosed by a State law adopted after November 19, 1974, if the disclosure 
concerns the juvenile justice system and its ability to serve, prior to adjudication, the student 
whose records are disclosed and the officials and authorities to whom the records are disclosed 
certify in writing to the school or district that the information will not be provided to any other 
party, without written consent, except as provided for under State law.7! 


67 34 CFR § 99.31 (a)(2)), 34 CFR § 99.34 

8 20 US.C. § 7917(b) 

©? 34 CFR §§ 99.7, 99.31 (a)(2), and 99.34(a)(1)(ii)) 
70 34 CFR § 99.34(a)(I) 

7! 34 CER §§ 99.31(a)(5) and 99.38 
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Release of Information Not Considered Education Records 


Personal Knowledge and Observation 


Q.36. 


Q.37. 


Does FERPA permit school officials to release information that they personally 
observed or of which they have personal knowledge? 


Because FERPA applies to the disclosure of education records and of Pll from education records 
that are maintained by the school, FERPA does not prohibit a school official from releasing 
information about a student that was obtained through the school official’s personal knowledge 
or observation, rather than from the student’s education records. 


Are there any limitations to sharing information based on personal knowledge or 
observations? 


The general rule regarding personal knowledge and observations does not apply where a school 
official learns of information about a student through his or her official role in making a 
determination about the student and the determination is maintained in an education record. 
For example, under FERPA, neither a principal nor any other school official who took official 
action to suspend a student may disclose information learned in that process, absent appropriate 
consent or an exception to consent under 34 CFR § 99.31 that permits the disclosure. 
However, the principal or other school official could disclose information about the student’s 
behavior that they personally observed. 
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Resources 

> U.S. Department of Education, Student Privacy Policy Office (formerly called the Family Policy 
Compliance Office): https://studentprivacy.ed.gov 

> U.S. Department of Education, Privacy Technical Assistance Center: 
https://studentprivacy.ed.gov 

> Family Educational Rights and Privacy Act Regulations: https://studentprivacy.ed.gov/ferpa- 
regulations 

> Federal regulations resources web page at the U.S. Department of Education: 
https://www.ed.gov/policy/gen/reg/edpicks.jhtm!| 

> U.S. Department of Education (2013): Guide for Developing High-Quality School Emergency 
Operations Plans, available at: http://rems.ed.gov/docs/REMS_K-1|2_Guide_508.pdf 

> U.S. Department of Education, Family Policy Compliance Office (2011): Addressing Emergencies 
on Campus, available at: https://studentprivacy.ed.gov/resources/addressing-emergencies-campus 

> U.S. Department of Education, Privacy Technical Assistance Center (2014): FERPA Exceptions 
Summary, available at https://studentprivacy.ed.gov/resources/ferpa-exceptions-summary-large- 
format-||-x-17 

> U.S. Department of Education, Privacy Technical Assistance Center, FAQs on Photos and 
Videos under FERPA, available at: https://studentprivacy.ed.gov/faq/faqs-photos-and-videos- 
under-ferpa 

> U.S. Department of Education, Family Policy Compliance Office (2017): Model Notification of 
Rights under FERPA for Elementary and Secondary Schools, available at: 
https://studentprivacy.ed.gov/node/490 

> Final Report of the Federal Commission on School Safety (2018), Chapter 13, "Training School 
Personnel to Help Ensure Student Safety," available at: https://www2.ed.gov/documents/school- 
safety/school-safety-report.pdf 

> United States Secret Service and U.S. Department of Education, (2004): Threat Assessment in 


Schools: A Guide to Managing Threatening Situations and to Creating Safe School Climates, 
available at: http://www.ed.gov/admins/lead/safety/edpicks.jhtml 
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Family Educational Rights and 
Privacy Act Regulations 


34 CFR Part 99 
Subpart A-General 
Section 


99.1 To which educational agencies or 
institutions do these regulations apply? 


99.2 What is the purpose of these 
regulations? 


99.3 What definitions apply to these 
regulations? 


99.4 What are the rights of parents? 
99.5 What are the rights of students? 


99.7 What must an educational agency 
or institution include in its annual 
notification? 


99.8 What provisions apply to records of 
a law enforcement unit? 


Subpart B-What are the Rights 
of Inspection and Review of 
Education Records? 


Section 


99.10 What rights exist for a parent or 
eligible student to inspect and review 
education records? 


99.11 May an educational agency or 
institution charge a fee for copies of 
education records? 


99.12 What limitations exist on the right 
to inspect and review records? 


Subpart C-What are the 
Procedures for Amending 
Education Records? 


Section 


99.20 How can a parent or eligible 
student request amendment of the 
student's education records? 


99.21 Under what conditions does a 
parent or eligible student have the right 
to a hearing? 


99.22 What minimum requirements exist 
for the conduct of a hearing? 


Subpart D-May an Educational 
Agency or Institution Disclose 
Personally Identifiable 
Information from Education 
Records? 


Section 


99.30 Under what conditions is prior 
consent required to disclose 
information? 


99.31 Under what conditions is prior 
consent not required to disclose 
information? 


99.32 What recordkeeping requirements 
exist concerning requests and 
disclosures? 


99.33 What limitations apply to the 
redisclosure of information? 


99.34 What conditions apply to 
disclosure of information to other 
educational agencies or institutions? 


99.35 What conditions apply to 
disclosure of information for Federal or 
State program purposes? 


99.36 What conditions apply to 
disclosure of information in health and 
safety emergencies? 


99.37 What conditions apply to 
disclosing directory information? 


99.38 What conditions apply to 
disclosure of information as permitted 
by State statute adopted after 
November 19, 1974, concerning the 
juvenile justice system? 


99.39 What definitions apply to the 
nonconsensual disclosure of records by 
postsecondary educational institutions in 
connection with disciplinary proceedings 
concerning crimes of violence or non- 
forcible sex offenses? 


Subpart E -What are the 
Enforcement Procedures? 


Section 


99.60 What functions has the Secretary 
delegated to the Office and to the Office 
of Administrative Law Judges? 


99.61 What responsibility does an 
educational agency or institution have 
concerning conflict with State or local 
laws? 


99.62 What information must an 
educational agency or institution submit 
to the Office? 


99.63 Where are complaints filed? 


99.64 What is the investigation 
procedure? 


99.65 What is the content of the notice 
of investigation issued by the Office? 


99.66 What are the responsibilities of the 
Office in the enforcement process? 


99.67 How does the Secretary enforce 
decisions? 


(Authority: 20 U.S.C. 1232g, unless 
otherwise noted). 


PART 99 - FAMILY EDUCATIONAL 
RIGHTS AND PRIVACY ACT (FERPA) 


The authority citation for this part 
continues to read as follows: 


(Authority: 20 U.S.C. 1232, unless 
otherwise noted). 


Subpart A-General 


§ 99.1 To which educational agencies 
or institutions do these regulations 


apply? 


(a) Except as otherwise noted in § 99.10, 
this part applies to an educational agency 
or institution to which funds have been 
made available under any program 
administered by the Secretary, 

if- 


(1)The educational institution provides 
educational services or instruction, or 
both, to students; or 


(2) The educational agency is authorized 
to direct and control public elementary 
or secondary, or postsecondary 
educational institutions. 


(b) This part does not apply to an 
educational agency or institution solely 
because students attending that agency 
or institution receive nonmonetary 
benefits under a program referenced in 
paragraph (a) of this section, if no funds 
under that program are made available to 
the agency or institution. 


(c) The Secretary considers funds to be 
made available to an educational agency 
or institution if funds under one or more 
of the programs referenced in paragraph 
(a) of this section- 


(1) Are provided to the agency or 
institution by grant, cooperative 
agreement, contract, subgrant, or 
subcontract; or (2) Are provided to 
students attending the agency or 
institution and the funds may be paid to 
the agency or institution by those 
students for educational purposes, such 
as under the Pell Grant Program and the 
Guaranteed Student Loan Program 
(Titles [V-A-1 and IV-B, respectively, of 
the Higher Education Act of 1965, as 
amended). 


(d) If an educational agency or 
institution receives funds under one or 
more of the programs covered by this 
section, the regulations in this part 
apply to the recipient as a whole, 
including each of its components (such 
as a department within a university). 


(Authority: 20 U.S.C. 1232g) 


§ 99.2 What is the purpose of these 
regulations? 


The purpose of this part is to set out 
requirements for the protection of 
privacy of parents and students under 
section 444 of the General Education 
Provisions Act, as amended. 


(Authority: 20 U.S.C. 1232g) 


Note to § 99.2: 34 CFR 300.610 through 
300.626 contain requirements regarding 
the confidentiality of information 
relating to children with disabilities who 
receive evaluations, services or other 
benefits under Part B of the Individuals 
with Disabilities Education Act (IDEA). 
34 CFR 303.402 and 303.460 identify 
the confidentiality of information 
requirements regarding children and 
infants and toddlers with disabilities and 
their families who receive evaluations, 
services, or other benefits under Part C 
of IDEA. 34 CFR 300.610 through 
300.627 contain the confidentiality of 
information requirements that apply to 
personally identifiable data, information, 
and records collected or maintained 
pursuant to Part B of the IDEA. 


§ 99.3 What definitions apply to these 
regulations? 


The following definitions apply to this 
part: 


"Act" means the Family Educational 
Rights and Privacy Act of 1974, as 
amended, enacted as section 444 of the 
General Education Provisions Act. 


(Authority: 20 U.S.C. 1232g) 


"Attendance" includes, but is not limited 
to- 


(a) Attendance in person or by paper 
correspondence, videoconference, 


satellite, Internet, or other electronic 
information and telecommunications 
technologies for students who are not 
physically present in the classroom; and 


(b) The period during which a person is 
working under a work-study program. 


(Authority: 20 U.S.C. 1232g) 


“Biometric record,” as used in the 
definition of “personally identifiable 
information,” means a record of one or 
more measurable biological or 
behavioral characteristics that can be 
used for automated recognition of an 
individual. Examples include 
fingerprints; retina and iris patterns; 
voiceprints; DNA sequence; facial 
characteristics; and handwriting. 


(Authority: 20 U.S.C. 1232g) 
"Dates of attendance" 


(a) The term means the period of time 
during which a student attends or 
attended an educational agency or 
institution. Examples of dates of 
attendance include an academic year, a 
spring semester, or a first quarter. 


(b) The term does not include specific 
daily records of a student's attendance at 
an educational agency or institution. 


(Authority: 20 U.S.C. 1232g (a)(5)(A)) 


"Directory information" means 
information contained in an education 
record of a student that would not 
generally be considered harmful or 
an invasion of privacy if disclosed. 


(a) Directory information includes, 
but is not limited to, the student's name; 


address; telephone listing; electronic 
mail address; photograph; date and place 
of birth; major field of study; grade 
level; enrollment status (e.g., 
undergraduate or graduate, full-time or 
part-time); dates of attendance; 
participation in officially recognized 
activities and sports; weight and height 
of members of athletic teams; degrees, 
honors and awards received; and the 
most recent educational agency or 
institution attended. 


(b) Directory information does not 
include a student's — 


(1) Social security number; or 


(2) Student identification (ID) number, 
except as provided in paragraph (c) of 
this section. 


(c) Directory information includes a 
student ID number, user ID, or other 
unique personal identifier used by the 
student for purposes of accessing or 
communicating in electronic systems, 
but only if the identifier cannot be used 
to gain access to education records 
except when used in conjunction with 
one or more factors that authenticate the 
user's identity, such as a personal 
identification number (PIN), password, 
or other factor known or possessed only 
by the authorized user. 


(Authority: 20 U.S.C. 1232¢(a)(5)(A)) 


“Disciplinary action or proceeding” 
means the investigation, adjudication, or 
imposition of sanctions by an 
educational agency or institution with 
respect to an infraction or violation of 
the internal rules of conduct applicable 
to students of the agency or institution. 


"Disclosure" means to permit access to 
or the release, transfer, or other 
communication of personally 
identifiable information contained in 
education records by any means, 
including oral, written, or electronic 
means, to any party except the party 
identified as the party that provided or 
created the record. 


(Authority: 20 U.S.C. 12328(b)(1) and 
(b)(2)) 


"Educational agency or institution” 
means any public or private agency or 
institution to which this part applies 
under § 99.1(a). 


(Authority: 20 U.S.C. 1232g (a)(3)) 
"Education Records" 


(a) The term means those records that 
are: 


(1) Directly related to a student; and 


(2) Maintained by an educational agency 
or institution or by a party acting for the 
agency or institution. 


(b) The term does not include: 


(1) Records that are kept in the sole 
possession of the maker, are used only as 
a personal memory aid, and are not 
accessible or revealed to any other 
person except a temporary substitute for 
the maker of the record. 


(2) Records of the law enforcement unit 
of an educational agency or institution, 
subject to the provisions of § 99.8. 


(3)() Records relating to an individual 
who is employed by an educational 
agency or institution, that: 


(A) Are made and maintained in the 
normal course of business; 


(B) Relate exclusively to the individual 
in that individual's capacity as an 
employee; and 


(C) Are not available for use for any 
other purpose. 


(ii) Records relating to an individual in 
attendance at the agency or institution 
who is employed as a result of his or her 
status as a student are education records 
and not excepted under paragraph 
(b)(3)Q) of this definition. 


(4) Records on a student who is 18 years 
of age or older, or is attending an 
institution of postsecondary education, 
that are: 


(i) Made or maintained by a physician, 
psychiatrist, psychologist, or other 
recognized professional or 
paraprofessional acting in his or her 
professional capacity or assisting in a 
paraprofessional capacity; 


(ii) Made, maintained, or used only in 
connection with treatment of the student; 
and 


(111) Disclosed only to individuals 
providing the treatment. For the purpose 
of this definition,"treatment" does not 
include remedial educational activities or 
activities that are part of the program of 
instruction at the agency or institution; 


(5) Records created or received by an 
educational agency or institution after an 


individual is no longer a student in 
attendance and that are not directly 
related to the individual's attendance as a 
student. 


(6) Grades on peer-graded papers before 
they are collected and recorded by a 
teacher. 


(Authority: 20 U.S.C. 1232g(a)(4)) 


"Eligible student" means a student who 
has reached 18 years of age or is 
attending an institution of postsecondary 
education. 


(Authority: 20 U.S.C. 1232g8(d)) 


"Institution of postsecondary education" 
means an institution that provides 
education to students beyond the 
secondary school level; "secondary 
school level" means the educational 
level (not beyond grade 12) at which 
secondary education is provided as 
determined under State law. 


(Authority: 20 U.S.C. 1232g(d)) 
"Parent" means a parent of a student and 
includes a natural parent, a guardian, or 
an individual acting as a parent in the 
absence of a parent or a guardian. 


(Authority: 20 U.S.C.1232g) 


"Party" means an individual, agency, 
institution, or organization. 


(Authority: 20 U.S.C. 1232g(b)(4)(A)) 
"Personally Identifiable Information" 
The term includes, but is not limited to-- 


(a) The student’s name; 


(b) The name of the student’s parent or 
other family members; 


(c) The address of the student or 
student’s family; 


(d) A personal identifier, such as the 
student’s social security number, student 
number, or biometric record; 


(e) Other indirect identifiers, such as the 
student’s date of birth, place of birth, 
and mother’s maiden name; 


(f) Other information that, alone or in 
combination, is linked or linkable to a 
specific student that would allow a 
reasonable person in the school 
community, who does not have personal 
knowledge of the relevant 
circumstances, to identify the student 
with reasonable certainty; or 


(g) Information requested by a person 
who the educational agency or 
institution reasonably believes knows the 
identity of the student to whom the 
education record relates. 


(Authority: 20 U.S.C. 1232g) 


"Record" means any information 
recorded in any way, including, but not 
limited to, hand writing, print, computer 
media, video or audio tape, film, 
microfilm, and microfiche. 


(Authority: 20 U.S.C. 1232g) 


"Secretary" means the Secretary of 

the U.S. Department of Education or an 
official or employee of the Department 
of Education acting for the Secretary 
under a delegation of authority. 


(Authority: 20 U.S.C.1232g) 


"Student," except as otherwise 
specifically provided in this part, means 
any individual who is or has been in 
attendance at an educational agency or 
institution and regarding whom the 
agency or institution maintains 
education records. 


(Authority: 20 U.S.C. 1232g(a)(6)) 
§ 99.4 What are the rights of parents? 


An educational agency or institution 
shall give full rights under the Act to 
either parent, unless the agency or 
institution has been provided with 
evidence that there is a court order, State 
statute, or legally binding document 
relating to such matters as divorce, 
separation, or custody that specifically 
revokes these rights. 


(Authority: 20 U.S.C. 1232g) 
§ 99.5 What are the rights of students? 


(a)(1) When a student becomes an 
eligible student, the rights accorded to, 
and consent required of, parents under 
this part transfer from the parents to the 
student. 


(2) Nothing in this section prevents an 
educational agency or institution from 
disclosing education records, or 
personally identifiable information from 
education records, to a parent without 
the prior written consent of an eligible 
student if the disclosure meets the 
conditions in § 99.31(a)(8), 

§ 99.31(a)(10), § 99.31(a)(15), or 

any other provision in § 99.31(a). 


(b) The Act and this part do not prevent 
educational agencies or institutions from 


giving students rights in addition to 
those given to parents. 


(c) An individual who is or has been a 
student at an educational institution and 
who applies for admission at another 
component of that institution does not 
have the rights under this part with 
respect to records maintained by that 
other component, including records 
maintained in connection with the 
student's application for admission, 
unless the student is accepted and 
attends that other component of the 
institution. 


(Authority: 20 U.S.C.1232g(d)) 


§ 99.7 What must an educational 
agency or institution include in its 
annual notification? 


(a)(1) Each educational agency or 
institution shall annually notify parents 
of students currently in attendance, or 
eligible students currently in attendance, 
of their rights under the Act and this 
part. 


(2) The notice must inform parents or 
eligible students that they have the right 
to- 


(1) Inspect and review the student's 
education records; 


(ii) Seek amendment of the student's 
education records that the parent or 
eligible student believes to be inaccurate, 
misleading, or otherwise in violation of 
the student's privacy rights; 


(111) Consent to disclosures of personally 
identifiable information contained in the 
student's education records, except to the 


extent that the Act and § 99.31 authorize 
disclosure without consent; and 


(iv) File with the Department a 
complaint under §§ 99.63 and 99.64 
concerning alleged failures by the 
educational agency or institution to 
comply with the requirements of the Act 
and this part. 


(3) The notice must include all of the 
following: 


(1) The procedure for exercising the right 
to inspect and review education records. 


(ii) The procedure for requesting 
amendment of records under § 99.20. 


(iii) If the educational agency or 
institution has a policy of disclosing 
education records under § 99.31 (a) (1), 
a specification of criteria for determining 
who constitutes a school official and 
what constitutes a legitimate educational 
interest. 


(b) An educational agency or institution 
may provide this notice by any means 
that are reasonably likely to inform the 
parents or eligible students of their 
rights. 


(1) An educational agency or institution 
shall effectively notify parents or 
eligible students who are disabled. 


(2) An agency or institution of 
elementary or secondary education shall 
effectively notify parents who have a 
primary or home language other than 
English. 


(Approved by the Office of Management 
and Budget under control number 1875- 
0246) 


(Authority: 20 U.S.C. 1232g (e) and (f)) 


§ 99.8 What provisions apply to records 
of a law enforcement unit? 


(a) (1) "Law enforcement unit" means 
any individual, office, department, 
division, or other component of an 
educational agency or institution, such as 
a unit of commissioned police officers or 
non-commissioned security guards, that 
is officially authorized or designated 

by that agency or institution to- 


(i) Enforce any local, State, or Federal 
law, or refer to appropriate authorities a 
matter for enforcement of any local, 
State, or Federal law against any 
individual or organization other than the 
agency or institution itself; or 


(ii) Maintain the physical security and 
safety of the agency or institution. 


(2) A component of an educational 
agency or institution does not lose its 
status as a "law enforcement unit" if it 
also performs other, non-law 
enforcement functions for the agency 
or institution, including investigation of 
incidents or conduct that constitutes or 
leads to a disciplinary action or 
proceedings against the student. 


(b) (1) Records of law enforcement unit 
means those records, files, documents, 
and other materials that are- 


(i) Created by a law enforcement unit; 


(ii) Created for a law enforcement 
purpose; and 


(iii) Maintained by the law enforcement 
unit. 


(2) Records of law enforcement unit 
does not mean — 


(i) Records created by a law enforcement 
unit for a law enforcement purpose that 
are maintained by a component of the 
educational agency or institution other 
than the law enforcement unit; or 


(ii) Records created and maintained by a 
law enforcement unit exclusively for a 
non-law enforcement purpose, such as a 
disciplinary action or proceeding 
conducted by the educational agency 

or institution. 


(c)(1)Nothing in the Act prohibits an 
educational agency or institution from 
contacting its law enforcement unit, 
orally or in writing, for the purpose of 
asking that unit to investigate a possible 
violation of, or to enforce, any local, 
State, or Federal law. 


(2) Education records, and personally 
identifiable information contained in 
education records, do not lose their 
status as education records and remain 
subject to the Act, including the 
disclosure provisions of § 99.30, while 
in possession of the law enforcement 
unit. 


(d) The Act neither requires nor 
prohibits the disclosure by any 
educational agency or institution of its 
law enforcement unit records. 


(Authority: 20 U.S.C. 1232g(a)(4)(B)(ii)) 


Subpart B-What are the Rights 
of Inspection and Review of 
Education Records? 


§ 99.10 What rights exist for a parent 
or eligible student to inspect and review 


education records? 


(a) Except as limited under § 99.12, a 
parent or eligible student must be given 
the opportunity to inspect and review the 
student's education records. This 
provision applies to 


(1) Any educational agency or 
institution; and 


(2) Any State educational agency (SEA) 
and its components. 


(1) For the purposes of subpart B of this 
part, an SEA and its components 
constitute an educational agency or 
institution. 


(ii) An SEA and its components are 
subject to subpart B of this part if the 
SEA maintains education records on 
students who are or have been in 
attendance at any school of an 
educational agency or institution subject 
to the Act and this part. 


(b) The educational agency or 
institution, or SEA or its component, 
shall comply with a request for access to 
records within a reasonable period of 
time, but not more than 45 days after it 
has received the request. 


(c) The educational agency or institution, 
or SEA or its component, shall respond 
to reasonable requests for explanations 
and interpretations of the records. 


(d) If circumstances effectively prevent 
the parent or eligible student from 
exercising the right to inspect and review 
the student's education records, the 
educational agency or institution, or 
SEA or its component, shall- 


(1) Provide the parent or eligible student 
with a copy of the records requested; or 


(2) Make other arrangements for the 
parent or eligible student to inspect and 
review the requested records. 


(e) The educational agency or institution, 
or SEA or its component, shall not 
destroy any education records if there is 
an outstanding request to inspect and 
review the records under this section. 


(f) While an educational agency or 
institution is not required to give an 
eligible student access to treatment 
records under paragraph (b)(4) of the 
definition of "Education records" in 

§ 99.3, the student may have those 
records reviewed by a physician or other 
appropriate professional of the student's 
choice. 


(Authority: 20 U.S.C. 12328(a)(1)(A) 
and (B)) 


§ 99.11 May an educational agency or 
institution charge a fee for copies of 
education records? 


(a) Unless the imposition of a fee 
effectively prevents a parent or eligible 
student from exercising the right to 
inspect and review the student's 
education records, an educational agency 
or institution may charge a fee for a copy 
of an education record which is made for 
the parent or eligible student. 


(b) An educational agency or institution 
may not charge a fee to search for or to 
retrieve the education records of a 
student. 


(Authority: 20 U.S.C. 1232¢(a)(1)) 


§ 99.12 What limitations exist on the 
right to inspect and review records? 
(a) If the education records of a student 
contain information on more than one 
student, the parent or eligible student 
may inspect and review or be informed 
of only the specific information about 
that student. 


(b) A postsecondary institution does not 
have to permit a student to inspect and 
review education records that are: 


(1) Financial records, including any 
information those records contain, of his 
or her parents; 


(2) Confidential letters and confidential 
statements of recommendation placed in 
the education records of the student 
before January 1, 1975, as long as the 
statements are used only for the purposes 
for which they were specifically 
intended; and 


(3) Confidential letters and confidential 
statements of recommendation placed in 
the student's education records after 
January 1, 1975, if: 


(i) The student has waived his or her 
right to inspect and review those letters 


and statements; and 


(ii) Those letters and statements are 
related to the student's: 


(A) Admission to an educational 
institution; 


(B) Application for employment; or 


(C) Receipt of an honor or honorary 
recognition. 
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(c)(1) A waiver under paragraph 
(b)(3)G) of this section is valid only if: 
(1) The educational agency or institution 
does not require the waiver as a 
condition for admission to or receipt of a 
service or benefit from the agency or 
institution; and 


(11) The waiver is made in writing and 
signed by the student, regardless of age. 


(2) If a student has waived his or her 
rights under paragraph (b)(3)(i) of this 
section, the educational institution shall: 


(i) Give the student, on request, the 
names of the individuals who provided 
the letters and statements of 
recommendation; and 


(ii) Use the letters and statements of 
recommendation only for the purpose for 
which they were intended. 


(3)G) A waiver under paragraph (b)(3)(i) 
of this section may be revoked with 
respect to any actions occurring after the 
revocation. 


(ii) A revocation under paragraph 
(c)(3)@) of this section must be in 
writing. 


(Authority: 20 U.S.C. 1232¢(a)(1) (A), 
(B), (C), and (D)) 


Subpart C-What Are the 
Procedures for Amending 
Education Records? 


§ 99.20 How can a parent or eligible 
student request amendment of the 


student's education records? 


(a) If a parent or eligible student believes 


the education records relating to the 
student contain information that is 
inaccurate, misleading, or in violation 
of the student's rights of privacy, he or 
she may ask the educational agency or 
institution to amend the record. 


(b) The educational agency or institution 
shall decide whether to amend the record 
as requested within a reasonable time 
after the agency or institution receives 
the request. 


(c) If the educational agency or 
institution decides not to amend the 
record as requested, it shall inform the 
parent or eligible student of its decision 
and of his or her right to a hearing under 
§ 99.21. 


(Authority: 20 U.S.C. 1232¢(a)(2)) 


§ 99.21 Under what conditions does a 
parent or eligible student have the right 
to a hearing? 


(a) An educational agency or institution 
shall give a parent or eligible student, on 
request, an opportunity for a hearing to 
challenge the content of the student's 
education records on the grounds that the 
information contained in the education 
records is inaccurate, misleading, or 

in violation of the privacy rights of the 
student. 


(b)(1) If, as a result of the hearing, the 
educational agency or institution decides 
that the information is inaccurate, 
misleading, or otherwise in violation of 
the privacy rights of the student, it shall: 


(i) Amend the record accordingly; and 


(ii) Inform the parent or eligible student 
of the amendment in writing. 
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(2) If, as a result of the hearing, the 
educational agency or institution decides 
that the information in the education 
record is not inaccurate, misleading, or 
otherwise in violation of the privacy 
rights of the student, it shall inform the 
parent or eligible student of the right to 
place a statement in the record 
commenting on the contested 
information in the record or stating why 
he or she disagrees with the decision of 
the agency or institution, or both. 


(c) If an educational agency or 
institution places a statement in the 
education records of a student under 
paragraph (b)(2) of this section, 

the agency or institution shall: 


(1) Maintain the statement with the 
contested part of the record for as long 
as the record is maintained; and 


(2) Disclose the statement whenever it 
discloses the portion of the record to 
which the statement relates. 


(Authority: 20 U.S.C. 1232¢(a)(2)) 


§ 99.22 What minimum requirements 
exist for the conduct of a hearing? 


The hearing required by § 99.21 must 
meet, at a minimum, the following 
requirements: 


(a) The educational agency or institution 
shall hold the hearing within a 
reasonable time after it has received the 
request for the hearing from the parent 
or eligible student. 


(b) The educational agency or institution 
shall give the parent or eligible student 
notice of the date, time, and place, 
reasonably in advance of the hearing. 


(c) The hearing may be conducted by 
any individual including an official of 
the educational agency or institution, 
who does not have direct interest in the 
outcome of the hearing. 


(d) The educational agency or institution 
shall give the parent or eligible student a 
full and fair opportunity to present 
evidence relevant to the issues raised 
under § 99.21. The parent or eligible 
student may, at their own expense, be 
assisted or represented by one or more 
individuals of his or her own choice, 
including an attorney. 


(e) The educational agency or institution 
shall make its decision in writing within 
a reasonable period of time after the 
hearing. 


(f) The decision must be based solely on 
the evidence presented at the hearing, 
and must include a summary of the 
evidence and the reasons for the 
decision. 


(Authority: 20 U.S.C. 1232g8(a)(2)) 


Subpart D-May an Educational 
Agency or Institution disclose 
Personally Identifiable 
Information from Education 
Records? 


§ 99.30 Under what conditions is prior 
consent required to disclose 
information? 


(a) The parent or eligible student shall 
provide a signed and dated written 
consent before an educational agency or 
institution discloses personally 
identifiable information from the 
student's education records, except as 
provided in § 99.31. 
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(b) The written consent must: 


(1) Specify the records that may be 
disclosed; 


(2) State the purpose of the disclosure; 
and 


(3) Identify the party or class of parties 
to whom the disclosure may be made. 


(c) When a disclosure is made under 
paragraph (a) of this section: 


(1) If a parent or eligible student so 
requests, the educational agency or 
institution shall provide him or her with 
a copy of the records disclosed; and 


(2) If the parent of a student who is not 
an eligible student so requests, the 
agency or institution shall provide the 
student with a copy of the records 
disclosed. 


(d) "Signed and dated written consent" 
under this part may include a record and 
signature in electronic form that- 


(1) Identifies and authenticates a 
particular person as the source of the 
electronic consent; and 


(2) Indicates such person's approval of 
the information contained in the 
electronic consent. 


(Authority: 20 U.S.C. 1232g (b)(1) and 
(b)(2)(A)) 


§ 99.31 Under what conditions is prior 
consent not required to disclose 
information? 


(a) An educational agency or institution 
may disclose personally identifiable 


information from an education record of 
a student without the consent required by 
§ 99.30 if the disclosure meets one or 
more of the following conditions: 


(1)G)(A) The disclosure is to other 
school officials, including teachers, 
within the agency or institution 
whom the agency or institution has 
determined to have legitimate 
educational interests. 


(B) A contractor, consultant, volunteer, 
or other party to whom an agency or 
institution has outsourced institutional 
services or functions may be considered 
a school official under this paragraph 
provided that the outside party-- 


(1) Performs an institutional service or 
function for which the agency or 
institution would otherwise use 
employees; 


(2) Is under the direct control of the 
agency or institution with respect to the 
use and maintenance of education 
records; and 


(3) Is subject to the requirements of 

§ 99.33(a) governing the use and 
redisclosure of personally identifiable 
information from education records. 


(ii) An educational agency or institution 
must use reasonable methods to ensure 
that school officials obtain access to only 
those education records in which they 
have legitimate educational interests. 

An educational agency or institution that 
does not use physical or technological 
access controls must ensure that its 
administrative policy for controlling 
access to education records is effective 
and that it remains in compliance with 
the legitimate educational interest 
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requirement in paragraph (a)(1)(i)(A) of 
this section. 


(2) The disclosure is, subject to the 
requirements of § 99.34, to officials of 
another school, school system, or 
institution of postsecondary education 
where the student seeks or intends to 
enroll, or where the student is already 
enrolled so long as the disclosure is for 
purposes related to the student’s 
enrollment or transfer. 


Note: Section 4155(b) of the No Child 
Left Behind Act of 2001, 20 U.S.C. 
7165(b), requires each State to assure the 
Secretary of Education that it has a 
procedure in place to facilitate the 
transfer of disciplinary records with 
respect to a suspension or expulsion of a 
student by a local educational agency to 
any private or public elementary or 
secondary school in which the student is 
subsequently enrolled or seeks, intends, 
or is instructed to enroll. 


(3) The disclosure is, subject to the 
requirements of § 99.35, to authorized 
representatives of- 


(1) The Comptroller General of the 
United States; 


(11) The Attorney General of the United 
States; 


(iii) The Secretary; or 


(iv) State and local educational 
authorities. 


(4)() The disclosure is in connection 
with financial aid for which the student 
has applied or which the student has 
received, if the information is necessary 
for such purposes as to: 


(A) Determine eligibility for the aid; 
(B) Determine the amount of the aid; 


(C) Determine the conditions for the 
aid; or 


(D) Enforce the terms and conditions of 
the aid. 


(ii) As used in paragraph (a)(4)(i) of this 
section,"financial aid" means a payment 
of funds provided to an individual (or a 
payment in kind of tangible or intangible 
property to the individual) that is 
conditioned on the individual's 
attendance at an educational agency or 
institution. 


(Authority: 20 U.S.C. 1232g(b)(1)(D)) 


(5)G) The disclosure is to State and local 
officials or authorities to whom this 
information is specifically- 


(A) Allowed to be reported or disclosed 
pursuant to a State statute adopted before 
November 19, 1974, if the allowed 
reporting or disclosure concerns the 
juvenile justice system and the system's 
ability to effectively serve the student 
whose records are released; or 


(B) Allowed to be reported or disclosed 
pursuant to a State statute adopted after 
November 19, 1974, subject to the 
requirements of § 99.38. 


(ii) Paragraph (a)(5)(1) of this section 
does not prevent a State from further 
limiting the number or type of State or 
local officials to whom disclosures may 
be made under that paragraph. 


(6)(i) The disclosure is to organizations 
conducting studies for, or on behalf of, 


14 


educational agencies or institutions to: 


(A) Develop, validate, or administer 
predictive tests; 


(B) Administer student aid programs; or 
(C) Improve instruction. 


(ii) An educational agency or institution 
may disclose information under 
paragraph (a)(6)(i) of this section only 
if-- 


(A) The study is conducted in a manner 
that does not permit personal 
identification of parents and students by 
individuals other than representatives of 
the organization that have legitimate 
interests in the information; 


(B) The information is destroyed when 
no longer needed for the purposes for 
which the study was conducted; and 


(C) The educational agency or 
institution enters into a written 
agreement with the organization that- 


(1) Specifies the purpose, scope, and 
duration of the study or studies and the 
information to be disclosed; 


(2) Requires the organization to use 
personally identifiable information from 
education records only to meet the 
purpose or purposes of the study as 
stated in the written agreement; 


(3) Requires the organization to conduct 
the study in a manner that does not 
permit personal identification of parents 
and students, as defined in this part, by 
anyone other than representatives of the 
organization with legitimate interests; 
and 


(4) Requires the organization to destroy 
or return to the educational agency or 
institution all personally identifiable 
information when the information is no 
longer needed for the purposes for which 
the study was conducted and specifies 
the time period in which the information 
must be returned or destroyed. 


(111) An educational agency or institution 
is not required to initiate a study or agree 
with or endorse the conclusions or 
results of the study. 


(iv) If this Office determines that a third 
party outside the educational agency or 
institution to whom information is 
disclosed under this paragraph (a)(6) 
violates paragraph (a)(6)(ii)(B) of this 
section, the educational agency or 
institution may not allow that third party 
access to personally identifiable 
information from education records for 
at least five years. 


(v) For the purposes of paragraph (a)(6) 
of this section, the term "organization" 
includes, but is not limited to, Federal, 
State, and local agencies, and 
independent organizations. 


(7) The disclosure is to accrediting 
organizations to carry out their 
accrediting functions. 


(8) The disclosure is to parents, as 
defined in § 99.3, of a dependent 
student, as defined in section 

152 of the Internal Revenue Code of 
1986. 


(9)(i) The disclosure is to comply with a 


judicial order or lawfully issued 
subpoena. 
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(11) The educational agency or institution 
may disclose information under 
paragraph (a)(9)(i) of this section only if 
the agency or institution makes 

a reasonable effort to notify the parent or 
eligible student of the order or subpoena 
in advance of compliance, so that the 
parent or eligible student may seek 
protective action, unless the disclosure is 
in compliance with- 


(A) A Federal grand jury subpoena and 
the court has ordered that the existence 
or the contents of the subpoena 

or the information furnished in response 
to the subpoena not be disclosed; 


(B) Any other subpoena issued for a law 
enforcement purpose and the court or 
other issuing agency has ordered that the 
existence or the contents of the subpoena 
or the information furnished in response 
to the subpoena not be disclosed; or 


(C) An ex parte court order obtained by 
the United States Attorney General (or 
designee not lower than an Assistant 
Attorney General) concerning 
investigations or prosecutions of an 
offense listed in 18 U.S.C. 
2332b(g)(5)(B) or an act of domestic or 
international terrorism as defined in 18 
U.S.C. 2331. 


(iii) (A) If an educational agency or 
institution initiates legal action against a 
parent or student, the educational agency 
or institution may disclose to the court, 
without a court order or subpoena, the 
education records of the student that are 
relevant for the educational agency or 
institution to proceed with the legal 
action as plaintiff. 


(B) If a parent or eligible student 
initiates legal action against an 


educational agency or institution, 

the educational agency or institution 
may disclose to the court, without a 
court order or subpoena, the student's 
education records that are relevant for 
the educational agency or institution 
to defend itself. 


(10) The disclosure is in connection with 
a health or safety emergency, under the 
conditions described in § 99.36. 


(11) The disclosure is information the 
educational agency or institution has 
designated as "directory information," 
under the conditions described in 

§ 99.37. 


(12) The disclosure is to the parent of a 
student who is not an eligible student or 
to the student. 


(13) The disclosure, subject to the 
requirements in § 99.39, is to a victim of 
an alleged perpetrator of a crime of 
violence or a non-forcible sex offense. 
The disclosure may only include the 
final results of the disciplinary 
proceeding conducted by the institution 
of postsecondary education with respect 
to that alleged crime or offense. The 
institution may disclose the final results 
of the disciplinary proceeding, 
regardless of whether the institution 
concluded a violation was committed. 


(14)(G) The disclosure, subject to the 
requirements in § 99.39, is in connection 
with a disciplinary proceeding at an 
institution of postsecondary education. 
The institution must not disclose the 
final results of the disciplinary 
proceeding unless it determines that 
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(A) The student is an alleged perpetrator 
of a crime of violence or non-forcible 
sex offense; and 


(B) With respect to the allegation made 
against him or her, the student has 
committed a violation of the institution's 
rules or policies. 


(11) The institution may not disclose the 
name of any other student, including a 
victim or witness, without the prior 
written consent of the other student. 


(iii) This section applies only to 
disciplinary proceedings in which the 
final results were reached on or after 
October 7, 1998. 


(15)G) The disclosure is to a parent of a 
student at an institution of postsecondary 
education regarding the student's 
violation of any Federal, State, or local 
law, or of any rule or policy of the 
institution, governing the use or 
possession of alcohol or a controlled 
substance if- 


(A) The institution determines that the 
student has committed a disciplinary 
violation with respect to that use or 
possession; and 


(B) The student is under the age of 21 at 
the time of the disclosure to the parent. 


(ii) Paragraph (a)(15) of this section does 
not supersede any provision of State law 
that prohibits an institution of 
postsecondary education from disclosing 
information. 


(16) The disclosure concerns sex 
offenders and other individuals required 
to register under section 170101 of the 
Violent Crime Control and Law 


Enforcement Act of 1994, 42 U.S.C. 
14071, and the information was provided 
to the educational agency or institution 
under 42 U.S.C. 14071 and applicable 
Federal guidelines. 


(b)(1) De-identified records and 
information. An educational agency or 
institution, or a party that has received 
education records or information from 
education records under this part, may 
release the records or information 
without the consent required by § 99.30 
after the removal of all personally 
identifiable information provided that 
the educational agency or institution or 
other party has made a reasonable 
determination that a student’s identity is 
not personally identifiable, whether 
through single or multiple releases, and 
taking into account other reasonably 
available information. 


(2) An educational agency or institution, 
or a party that has received education 
records or information from education 
records under this part, may release de- 
identified student level data from 
education records for the purpose of 
education research by attaching a code to 
each record that may allow the recipient 
to match information received from the 
same source, provided that-- 


(i) An educational agency or institution 
or other party that releases de-identified 
data under paragraph (b)(2) of this 
section does not disclose any 
information about how it generates and 
assigns a record code, or that would 
allow a recipient to identify a student 
based on a record code; 


(ii) The record code is used for no 


purpose other than identifying a de- 
identified record for purposes of 
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education research and cannot be used to 
ascertain personally identifiable 
information about a student; and 


(iii) The record code is not based on a 
student’s social security number or other 
personal information. 


(c) An educational agency or institution 
must use reasonable methods to identify 
and authenticate the identity of parents, 
students, school officials, and any other 
parties to whom the agency or institution 
discloses personally identifiable 
information from education records. 


(d) Paragraphs (a) and (b) of this section 
do not require an educational agency or 
institution or any other party to disclose 
education records or information from 
education records to any party except for 
parties under paragraph (a)(12) of this 
section. 


(Authority: 20 U.S.C. 1232¢(a)(5)(A), 
(b), (h), (i), and (j)) 


§ 99.32 What recordkeeping 
requirements exist concerning requests 
and disclosures? 


(a)(1) An educational agency or 
institution must maintain a record of 
each request for access to and each 
disclosure of personally identifiable 
information from the education records 
of each student, as well as the names of 
State and local educational authorities 
and Federal officials and agencies listed 
in § 99.31(a)(3) that may make further 
disclosures of personally identifiable 
information from the student’s education 
records without consent under 

§ 99.33(b). 


(2) The agency or institution shall 
maintain the record with the education 
records of the student as long as the 
records are maintained. 


(3) For each request or disclosure the 
record must include: 


(1) The parties who have requested or 
received personally identifiable 
information from the education records; 
and 


(ii) The legitimate interests the parties 
had in requesting or obtaining the 
information. 


(4) An educational agency or institution 
must obtain a copy of the record of 
further disclosures maintained under 
paragraph (b)(2) of this section and 
make it available in response to a 
parent’s or eligible student’s request to 
review the record required under 
paragraph (a)(1) of this section. 


(5) An educational agency or institution 
must record the following information 
when it discloses personally identifiable 
information from education records 
under the health or safety emergency 
exception in § 99.31(a)(10) and § 99.36: 


(1) The articulable and significant threat 
to the health or safety of a student or 
other individuals that formed the basis 
for the disclosure; and 


(ii) The parties to whom the agency or 
institution disclosed the information. 


(b)(1) Except as provided in paragraph 
(b)(2) of this section, if an educational 
agency or institution discloses personally 
identifiable information from education 
records with the understanding 
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authorized under § 99.33(b), the record 
of the disclosure required under this 
section must include: 


(i) The names of the additional parties to 
which the receiving party may disclose 
the information on behalf of the 
educational agency or institution; and 


(11) The legitimate interests under 

§$ 99.31 which each of the additional 
parties has in requesting or obtaining the 
information. 


(2)q) A State or local educational 
authority or Federal official or agency 
listed in § 99.31(a)(3) that makes further 
disclosures of information from 
education records under § 99.33(b) must 
record the names of the additional 
parties to which it discloses information 
on behalf of an educational agency or 
institution and their legitimate interests 
in the information under § 99.31 if the 
information was received from: 


(A) An educational agency or institution 
that has not recorded the further 
disclosures under paragraph (b)(1) of 
this section; or 


(B) Another State or local educational 
authority or Federal official or agency 
listed in § 99.31(a)(3). 


(ii) A State or local educational 
authority or Federal official or agency 
that records further disclosures of 
information under paragraph (b)(2)(i) of 
this section may maintain the record by 
the student’s class, school, district, or 
other appropriate grouping rather than 
by the name of the student. 


(iii) Upon request of an educational 
agency or institution, a State or local 


educational authority or Federal official 
or agency listed in § 99.31(a)(3) that 
maintains a record of further disclosures 
under paragraph (b)(2)(i) of this section 
must provide a copy of the record of 
further disclosures to the educational 
agency or institution within a reasonable 
period of time not to exceed 30 days. 


(c) The following parties may inspect the 
record relating to each student: 


(1) The parent or eligible student. 


(2) The school official or his or her 
assistants who are responsible for the 
custody of the records. 


(3) Those parties authorized in 

§ 99.31(a)(1) and (3) for the purposes of 
auditing the recordkeeping procedures of 
the educational agency or institution. 


(d) Paragraph (a) of this section does not 
apply if the request was from, or the 
disclosure was to: 


(1) The parent or eligible student; 


(2) A school official under § 99.31 
(a)(1); 


(3) A party with written consent from 
the parent or eligible student; 


(4) A party seeking directory 
information; or 


(5) A party seeking or receiving records 
in accordance with § 99.31(a)(9)(ii)(A) 
through (C). 


(Approved by the Office of Management 


and Budget under control number 1875- 
0246) 
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(Authority: 20 U.S.C. 12328(b)(1) and 
(b)(4)(A) 


§ 99.33 What limitations apply to the 
redisclosure of information? 


(a)(1) An educational agency or 
institution may disclose personally 
identifiable information from an 
education record only on the condition 
that the party to whom the information is 
disclosed will not disclose the 
information to any other party without 
the prior consent of the parent or eligible 
student. 


(2) The officers, employees, and agents 
of a party that receives information 
under paragraph (a)(1) of this section 
may use the information, but only for the 
purposes for which the disclosure was 
made. 


(b)(1) Paragraph (a) of this section does 
not prevent an educational agency or 
institution from disclosing personally 
identifiable information with the 
understanding that the party receiving 
the information may make further 
disclosures of the information on behalf 
of the educational agency or institution 
if-- 


(i) The disclosures meet the 
requirements of § 99.31; and 


(ii) (A) The educational agency or 
institution has complied with the 
requirements of § 99.32(b); or 


(B) A State or local educational 
authority or Federal official or agency 
listed in § 99.31(a)(3) has complied with 
the requirements of § 99.32(b)(2). 


(2) A party that receives a court order or 
lawfully issued subpoena and rediscloses 
personally identifiable information from 
education records on behalf of an 
educational agency or institution in 
response to that order or subpoena under 
§ 99.31(a)(9) must provide the 
notification required under 

§ 99.31(a)(9)(1). 


(c) Paragraph (a) of this section does not 
apply to disclosures under 

§§ 99.31(a)(8), (9), 1), 2), 14), C15), 
and (16), and to information that 
postsecondary institutions are required to 
disclose under the Jeanne Clery 
Disclosure of Campus Security Policy 
and Campus Crime Statistics Act, 20 
U.S.C. 1092(f) (Clery Act), to the 
accuser and accused regarding the 
outcome of any campus disciplinary 
proceeding brought alleging a sexual 
offense. 


(d) An educational agency or institution 
must inform a party to whom disclosure 
is made of the requirements of paragraph 
(a) of this section except for disclosures 
made under §§ 99.31(a)(8), (9), (11), 
(12), (14), (15), and (16), and to 
information that postsecondary 
institutions are required to disclose 
under the Clery Act to the accuser and 
accused regarding the outcome of any 
campus disciplinary proceeding brought 
alleging a sexual offense. 


(e) If this Office determines that a third 
party outside the educational agency or 
institution improperly rediscloses 
personally identifiable information from 
education records in violation of this 
section, or fails to provide the 
notification required under paragraph 
(b)(2) of this section, the educational 
agency or institution may not allow that 
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third party access to personally 
identifiable information from education 
records for at least five years. 


(Authority: 20 U.S.C.1232g(b)(4)(B)) 


§ 99.34 What conditions apply to 
disclosure of information to other 
educational agencies or institutions? 


(a) An educational agency or institution 
that discloses an education record under 
§ 99.31(a) (2) shall: 


(1) Make a reasonable attempt to notify 
the parent or eligible student at the last 
known address of the parent or eligible 
student, unless: 


(i) The disclosure is initiated by the 
parent or eligible student; or 


(ii) The annual notification of the agency 
or institution under § 99.7 includes a 
notice that the agency or institution 
forwards education records to other 
agencies or institutions that have 
requested the records and in which the 
student seeks or intends to enroll or is 
already enrolled so long as the disclosure 
is for purposes related to the student’s 
enrollment or transfer; 


(2) Give the parent or eligible student, 
upon request, a copy of the record that 
was disclosed; and 


(3) Give the parent or eligible student, 
upon request, an opportunity for a 
hearing under Subpart C. 


(b) An educational agency or institution 
may disclose an education record of a 
student in attendance to another 
educational agency or institution 

if: 


(1) The student is enrolled in or receives 
services from the other agency or 
institution; and 


(2) The disclosure meets the 
requirements of paragraph (a) of this 
section. 


(Authority: 20 U.S.C. 1232¢(b)(1)(B)) 


§ 99.35 What conditions apply to 
disclosure of information for Federal 
or State program purposes? 


(a)(1) Authorized representatives of the 
officials or agencies headed by officials 
listed in § 99.31(a)(3) may have access 
to education records in connection with 
an audit or evaluation of Federal or State 
supported education programs, or for the 
enforcement of or compliance with 
Federal legal requirements that relate to 
those programs. 


(2) Authority for an agency or official 
listed in § 99.31(a)(3) to conduct an 
audit, evaluation, or compliance or 
enforcement activity is not conferred by 
the Act or this part and must be 
established under other Federal, State, or 
local authority. 


(b) Information that is collected under 
paragraph (a) of this section must: 


(1) Be protected in a manner that does 
not permit personal identification of 
individuals by anyone other than the 
officials or agencies headed by officials 
referred to in paragraph (a) of this 
section, except that those officials and 
agencies may make further disclosures 
of personally identifiable information 
from education records on behalf of the 
educational agency or institution in 
accordance with the requirements of 


21 


§ 99.33(b); and 


(2) Be destroyed when no longer needed 
for the purposes listed in paragraph (a) 
of this section. 


(c) Paragraph (b) of this section does not 
apply if: 


(1) The parent or eligible student has 
given written consent for the disclosure 
under § 99.30; or 


(2) The collection of personally 
identifiable information is specifically 
authorized by Federal law. 


(Authority: 20 U.S.C.1232¢(b)(3)) 


§ 99.36 What conditions apply to 
disclosure of information in health and 
safety emergencies? 


(a) An educational agency or institution 
may disclose personally identifiable 
information from an education record to 
appropriate parties, including parents of 
an eligible student, in connection with an 
emergency if knowledge of the 
information is necessary to protect the 
health or safety of the student or other 
individuals. 


(b) Nothing in the Act or this part shall 
prevent an educational agency or 
institution from- 


(1) Including in the education records of 
a student appropriate information 
concerning disciplinary action taken 
against the student for conduct that 
posed a significant risk to the safety 

or well-being of that student, other 
students, or other members of the school 
community; 


(2) Disclosing appropriate information 
maintained under paragraph (b)(1) of 
this section to teachers and school 
officials within the agency or institution 
who the agency or institution has 
determined have legitimate educational 
interests in the behavior of the student; 
or 


(3) Disclosing appropriate information 
maintained under paragraph (b)(1) of 
this section to teachers and school 
officials in other schools who have been 
determined to have legitimate 
educational interests in the behavior of 
the student. 


(c) In making a determination under 
paragraph (a) of this section, an 
educational agency or institution may 
take into account the totality of the 
circumstances pertaining to a threat to 
the health or safety of a student or other 
individuals. If the educational agency or 
institution determines that there is an 
articulable and significant threat to the 
health or safety of a student or other 
individuals, it may disclose information 
from education records to any person 
whose knowledge of the information is 
necessary to protect the health or safety 
of the student or other individuals. If, 
based on the information available at the 
time of the determination, there is a 
rational basis for the determination, the 
Department will not substitute its 
judgment for that of the educational 
agency or institution in evaluating the 
circumstances and making its 
determination. 


(Authority: 20 U.S.C. 1232g (b)(1)(I) 
and (h)) 


§ 99.37 What conditions apply to 
disclosing directory information? 
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(a) An educational agency or institution 
may disclose directory information if it 
has given public notice to parents of 
students in attendance and eligible 
students in attendance at the agency 

or institution of: 


(1) The types of personally identifiable 
information that the agency or institution 
has designated as directory information; 


(2) A parent's or eligible student's right 
to refuse to let the agency or institution 
designate any or all of those types of 
information about the student designated 
as directory information; and 


(3) The period of time within which a 
parent or eligible student has to notify 
the agency or institution in writing that 
he or she does not want any or all of 
those types of information about the 
student designated as directory 
information. 


(b) An educational agency or institution 
may disclose directory information about 
former students without complying with 
the notice and opt out conditions in 
paragraph (a) of this section. However, 
the agency or institution must continue 
to honor any valid request to opt out of 
the disclosure of directory information 
made while a student was in attendance 
unless the student rescinds the opt out 
request. 


(c) A parent or eligible student may not 
use the right under paragraph (a)(2) of 
this section to opt out of directory 
information disclosures to prevent an 
educational agency or institution from 
disclosing or requiring a student to 
disclose the student’s name, identifier, or 
institutional e-mail address in a class in 
which the student is enrolled. 


(d) An educational agency or institution 
may not disclose or confirm directory 
information without meeting the written 
consent requirements in § 99.30 if a 
student’s social security number or other 
non-directory information is used alone 
or combined with other data elements to 
identify or help identify the student or 
the student’s records. 


(Authority: 20 U.S.C. 1232g (a)(5) (A) 
and (B)) 


§ 99.38 What conditions apply to 
disclosure of information as permitted 
by State statute adopted after 
November 19, 1974, concerning the 
juvenile justice system? 


(a) If reporting or disclosure allowed by 
State statute concerns the juvenile justice 
system and the system's ability to 
effectively serve, prior to adjudication, 
the student whose records are released, 
an educational agency or institution may 
disclose education records under 

§ 99.31(a)(5)()(B). 


(b) The officials and authorities to whom 
the records are disclosed shall certify in 
writing to the educational agency or 
institution that the information will not 
be disclosed to any other party, except as 
provided under State law, without the 
prior written consent of the parent of 

the student. 


(Authority: 20 U.S.C. 1232g((b)(1)(J)) 


§ 99.39 What definitions apply to the 
nonconsensual disclosure of records by 
postsecondary educational institutions 
in connection with disciplinary 
proceedings concerning crimes of 
violence or nonforcible sex offenses? 
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As used in this part: 


"Alleged perpetrator of a crime of 
violence" is a student who is alleged to 
have committed acts that would, if 
proven, constitute any of the 
following offenses or attempts to 
commit the following offenses that are 
defined in appendix A to this part: 


Arson 

Assault offenses 

Burglary 

Criminal homicide-manslaughter 
by negligence 

Criminal homicide-murder and 
nonnegligent manslaughter 
Destruction/damage/vandalism of 
property 

Kidnapping/abduction 

Robbery 

Forcible sex offenses 


"Alleged perpetrator of a nonforcible sex 
offense" means a student who is alleged 
to have committed acts that, if proven, 
would constitute statutory rape or incest. 
These offenses are defined in appendix 
A to this part. 


"Final results" means a decision or 
determination, made by an honor court 
or council, committee, commission, or 
other entity authorized to resolve 
disciplinary matters within the 
institution. The disclosure of final results 
must include only the name of the 
student, the violation committed, and 
any sanction imposed by the institution 
against the student. 

"Sanction imposed" means a description 
of the disciplinary action taken by the 
institution, the date of its imposition, and 
its duration. 


"Violation committed" means the 
institutional rules or code sections that 
were violated and any essential findings 
supporting the institution's conclusion 
that the violation was committed. 


(Authority: 20 U.S.C.1232g (b)(6)) 


Subpart E-What are the 
Enforcement Procedures? 


§ 99.60 What functions has the 
Secretary delegated to the Office and to 
the Office of Administrative Law 
Judges? 


(a) For the purposes of this subpart, 
"Office" means the Family Policy 
Compliance Office, U.S. 
Department of Education. 


(b) The Secretary designates the Office 
to: 


(1) Investigate, process, and review 
complaints and violations under the Act 
and this part; and 


(2) Provide technical assistance to 
ensure compliance with the Act and this 
part. 


(c) The Secretary designates the Office 
of Administrative Law Judges to act as 
the Review Board required under the Act 
to enforce the Act with respect to all 
applicable programs. The term 
"applicable program" is defined in 
section 400 of the General Education 
Provisions Act. 

(Authority: 20 U.S.C. 1232 (f) and (g), 
1234)) 


§ 99.61 What responsibility does an 


educational agency or institution have 
concerning conflict with State or local 
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laws? 


If an educational agency or institution 
determines that it cannot comply with 
the Act or this part due to a conflict with 
State or local law, it shall notify the 
Office within 45 days, giving the text 
and citation of the conflicting law. 


(Authority: 20 U.S.C. 1232g (f)) 


§ 99.62 What information must an 
educational agency or institution 
submit to the Office? 


The Office may require an educational 
agency or institution to submit reports, 
information on policies and procedures, 
annual notifications, training materials, 
and other information necessary to carry 
out its enforcement responsibilities 
under the Act or this part. 


(Authority: 20 U.S.C. 1232g(f) and (g)) 
§ 99.63 Where are complaints filed? 


A parent or eligible student may file a 
written complaint with the Office 
regarding an alleged violation under the 
Act and this part. The Office's address 
is: Family Policy Compliance 

Office, U.S. Department of Education, 
400 Maryland Avenue, S.W., 
Washington, DC 20202. 


(Authority: 20 U.S.C. 12328(g)) 


§ 99.64 What is the investigation 
procedure? 


(a) A complaint must contain specific 
allegations of fact giving reasonable 
cause to believe that a violation of the 
Act or this part has occurred. A 
complaint does not have to allege that a 


violation is based on a policy or practice 
of the educational agency or institution. 


(b) The Office investigates a timely 
complaint filed by a parent or eligible 
student, or conducts its own 
investigation when no complaint has 
been filed or a complaint has been 
withdrawn, to determine whether an 
educational agency or institution has 
failed to comply with a provision of the 
Act or this part. If the Office determines 
that an educational agency or institution 
has failed to comply with a provision of 
the Act or this part, it may also 
determine whether the failure to comply 
is based on a policy or practice of the 
agency or institution. 


(c) A timely complaint is defined as an 
allegation of a violation of the Act that is 
submitted to the Office within 180 days 
of the date of the alleged violation 

or of the date that the complainant knew 
or reasonably should have known of the 
alleged violation. 


(d) The Office may extend the time limit 
in this section for good cause shown. 


(Authority: 20 U.S.C. 1232g(f)) 


§ 99.65 What is the content of the 
notice of investigation issued by the 
Office? 


(a) The Office notifies the complainant, 
if any, and the educational agency or 
institution in writing if it initiates an 
investigation under § 99.64(b). The 
notice to the educational agency or 
institution-- 


(1) Includes the substance of the 


allegations against the educational 
agency or institution; and 
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(2) Directs the agency or institution to 
submit a written response and other 
relevant information, as set forth in 

§ 99.62, within a specified period of 
time, including information about its 
policies and practices regarding 
education records. 


(b) The Office notifies the complainant 
if it does not initiate an investigation 
because the complaint fails to meet the 
requirements of § 99.64. 


(Authority: 20 U.S.C. 12328(g)) 


§ 99.66 What are the responsibilities of 
the Office in the enforcement process? 


(a) The Office reviews a complaint, if 
any, information submitted by the 
educational agency or institution, and 
any other relevant information. The 
Office may permit the parties to submit 
further written or oral arguments or 
information. 


(b) Following its investigation, the 
Office provides to the complainant, if 
any, and the educational agency or 
institution a written notice of its findings 
and the basis for its findings. 


(c) If the Office finds that an educational 
agency or institution has not complied 


with a provision of the Act or this part, it 


may also find that the failure to comply 
was based on a policy or practice of the 
agency or institution. A notice of 
findings issued under paragraph (b) of 
this section to an educational agency or 
institution that has not complied with a 
provision of the Act or this part-- 


(1) Includes a statement of the specific 
steps that the agency or institution must 
take to comply; and 


(2) Provides a reasonable period of time, 
given all of the circumstances of the 
case, during which the educational 
agency or institution may comply 
voluntarily. 


(Authority:20 U.S.C. 1232(f)) 


§ 99.67 How does the Secretary enforce 
decisions? 


(a) If an educational agency or 
institution does not comply during the 
period of time set under § 99.66(c), the 
Secretary may take any legally available 
enforcement action in accordance with 
the Act, including, but not limited to, the 
following enforcement actions available 
in accordance with part E of the General 
Education Provisions Act-- 


(1) Withhold further payments under any 
applicable program; 


(2) Issue a complaint to compel 
compliance through a cease-and-desist 
order; or 


(3) Terminate eligibility to receive 
funding under any applicable program. 


(b) If, after an investigation under 

§ 99.66, the Secretary finds that an 
educational agency or institution has 
complied voluntarily with the Act 

or this part, the Secretary provides the 
complainant and the agency or 
institution written notice of the decision 
and the basis for the decision. 
(NOTE: 34 CER part 78 contains the 
regulations of the Education Appeal 
Board.) 


(Authority: 20 U.S.C. 1232g(f); 20 
U.S.C. 1234) 
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Appendix A to Part 99 - Crimes 
of Violence Definitions 


Arson 

Any willful or malicious burning or 
attempt to burn, with or without intent to 
defraud, a dwelling house, public 
building, motor vehicle or aircraft, 
personal property of another, etc. 


Assault Offenses 
An unlawful attack by one person upon 
another. 


(NOTE: By definition there can be no 
"attempted" assaults, only "completed" 
assaults.) 


(ii) Aggravated Assault 

An unlawful attack by one person upon 
another for the purpose of inflicting 
severe or aggravated bodily injury. This 
type of assault usually is accompanied 
by the use of a weapon or by means 
likely to produce death or great bodily 
harm. (It is not necessary that injury 
result from an aggravated assault when a 
gun, knife, or other weapon is used 
which could and probably would result 
in serious injury if the crime were 
successfully completed.) 


(b) Simple Assault 

An unlawful physical attack by one 
person upon another where neither the 
offender displays a weapon, nor the 
victim suffers obvious severe or 
aggravated bodily injury involving 
apparent broken bones, loss of teeth, 
possible internal injury, severe 
laceration, or loss of consciousness. 


(c) Intimidation 

To unlawfully place another person in 
reasonable fear of bodily harm through 
the use of threatening words or other 


conduct, or both, but without displaying 
a weapon or subjecting the victim to 
actual physical attack. 


(NOTE: This offense includes stalking.) 


Burglary 

The unlawful entry into a building or 
other structure with the intent to commit 
a felony or a theft. 


Criminal Homicide-Manslaughter by 
Negligence 

The killing of another person through 
gross negligence. 


Criminal Homicide-Murder and 
Nonnegligent Manslaughter 

The willful (nonnegligent) killing of one 
human being by another. 


Destruction/Damage/Vandalism of 
Property 

To willfully or maliciously destroy, 
damage, deface, or otherwise injure real 
or personal property without the consent 
of the owner or the person having 
custody or control of it. 


Kidnapping/Abduction 

The unlawful seizure, transportation, or 
detention of a person, or any 
combination of these actions, against his 
or her will, or of a minor without the 
consent of his or her custodial parent(s) 
or legal guardian. 


(NOTE: Kidnapping/Abduction includes 
hostage taking.) 


Robbery 

The taking of, or attempting to take, 
anything of value under confrontational 
circumstances from the control, custody, 
or care of a person or persons by force or 


P| 


threat of force or violence or by putting 
the victim in fear. 


(NOTE: Carjackings are robbery 
offenses where a motor vehicle is taken 
through force or threat of force.) 


Sex Offences, Forcible 

Any sexual act directed against another 
person, forcibly or against that person's 
will, or both; or not forcibly or against 
the person's will where the victim is 
incapable of giving consent. 


(a)Forcible Rape (Except "Statutory 
Rape") 

The carnal knowledge of a person, 
forcibly or against that person's will, or 
both; or not forcibly or against the 
person's will where the victim is 
incapable of giving consent because of 
his or her temporary or permanent 
mental or physical incapacity (or 
because of his or her youth). 


(b) Forcible Sodomy 

Oral or anal sexual intercourse with 
another person, forcibly or against that 
person's will, or both; or not forcibly or 
against the person's will where the 
victim is incapable of giving consent 


because of his or her youth or because of 


his or her temporary or permanent 
mental or physical incapacity. 


(b) Sexual Assault With An Object 

To use an object or instrument to 
unlawfully penetrate, however slightly, 
the genital or anal opening of the body 
of another person, forcibly or against 


that person's will, or both; or not forcibly 


or against the person’s will where the 
victim is incapable of giving consent 


because of his or her youth or because of 


his or her temporary or permanent 
mental or physical incapacity. 


(NOTE: An "object" or "instrument" is 
anything used by the offender other than 
the offender's genitalia. Examples are a 
finger, bottle, handgun, stick, etc..) 


(d) Forcible Fondling. 

The touching of the private body parts of 
another person for the purpose of sexual 
gratification, forcibly or against that 
person's will, or both; or not forcibly or 
against the person's will where the 
victim is incapable of giving consent 
because of his or her youth or because of 
his or her temporary or permanent 
mental or physical incapacity. 


(NOTE: Forcible Fondling includes 
"Indecent Liberties" and "Child 
Molesting.") 


Nonforcible Sex Offenses 
(Except "Prostitution Offenses") 
Unlawful, nonforcible sexual 
intercourse. 


(a) Incest 

Nonforcible sexual intercourse between 
persons who are related to each other 
within the degrees wherein marriage is 
prohibited by law. 


(b)Statutory Rape 

Nonforcible sexual intercourse with a 
person who is under the statutory age of 
consent. 


(Authority: 20 U.S.C. 1232g(b)(6) and 
18 U.S.C. 16) 


[This is not an official version of the 
regulations. These regulations are 
codified in 34 CFR Part 

99.] 


[Updated January 2009. ] 
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VIRGINIA MODEL 
MEMORANDUM OF UNDERSTANDING 


between 
THE SCHOOL BOARD/SCHOOL DIVISION 
and 
THE POLICE DEPARTMENT/SHERIFF’S OFFICE [DATE] 


PURPOSE 


The [School Board/School Division (SD)] and [Police Department/Sheriff’s Office (PD/SO)] hereby enter 
into this Memorandum of Understanding (MOU) setting forth the respective roles and responsibilities of 
both parties regarding the use of school resource officers (SROs). The purpose of this MOU is to 
establish a mutually beneficial partnership (School—Law Enforcement Partnership (SLEP)) that both 
schools and law enforcement can work within to achieve shared goals. The purpose of the SLEP is to 
foster relations of mutual respect and understanding in order to build a positive and safe school 
environment and to facilitate effective, timely communication and coordination of efforts for both the 
SD and the PD/SO. 


This MOU is intended only to outline expectations between the SD and the PD/SO. It is not intended to 
create contractual or equitable obligations on the part of the SD or the PD/SO toward particular students, 
parents, SD or PD/SO employees, or any other third parties. 


The parties agree the vast majority of student misconduct can be best addressed through classroom and 
in-school strategies. The parties acknowledge that students are generally less mature and responsible 
than adults; they often lack the maturity, experience, perspective, and judgment to recognize and avoid 
choices that could be detrimental to them; and they are more susceptible to outside pressures than 
adults. 


For further details regarding the SLEP, please see the School and Law Enforcement Partnership Guide. 


GOALS 


The primary goals of the SLEP and this model MOU are to (i) promote positive and supportive school 
climates and (ii) create and maintain safe and secure school environments. 


To promote positive and supportive school climates, the SD and PD/SO will collaborate to increase law- 
related education, expand school safety and crime prevention efforts, reduce conflict, and support 
effective interventions for students. 


To create and maintain safe and secure school environments, the SD and PD/SO will collaborate to 


reduce and prevent crime, violence, victimization, and fear in and around schools, and minimize student 
involvement with the juvenile and criminal justice systems. 
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EVALUATION OF THE SCHOOL—LAW ENFORCEMENT PARTNERSHIP 


The SD and the PD/SO should jointly develop measurable objectives of the SLEP using school discipline, 
crime, and violence data, school climate survey data, and any other data deemed to be relevant. The SD 
and the PD/SO will review progress toward achieving such objectives at least annually and the results of 
the progress review will be made available to the public. 


ROLES AND RESPONSIBILITIES 


1. Police Department/Sheriff’s Office Responsibilities 


The PD/SO will designate a direct point of contact between the PD/SO and the SD. The PD/SO point of 
contact will address any operational and administrative issues and will serve as a consultant for school 
safety and security issues including assessments and critical incident response planning. The PD/SO 
point of contact will maintain a working knowledge of school rules, regulations, and laws regarding 
student safety and conduct. The PD/SO point of contact will establish and maintain effective 
relationships with school personnel at the division and school levels. 


The PD/SO will be responsible for the selection, assignment, scheduling, training, supervision, and 
evaluation of school resource officers (SROs). In their performance of law enforcement functions, the 
SRO will remain at all times under the control, through the chain of command, of the PD/SO. The 
PD/SO will ensure the SRO meets the training standards for SROs established by the Virginia 
Department of Criminal Justice Services (DCJS) pursuant to Virginia Code §§ 9.1-101(54) and 9.1-114.1. 


The PD/SO will take into consideration the views of the SD and the identified needs and conditions of the 
schools when (i) developing and implementing law enforcement policies and practices that may affect 
schools and (ii) selecting, assigning, scheduling, training, supervising, and evaluating SROs. 


Il. School Division Responsibilities 


The SD will designate a primary division-level point of contact between the SD and the PD/SO. The SD 
point of contact will implement the SLEP and maintain ongoing communications with PD/SO officials. 


School administrators will be responsible for facilitating effective communication between the SRO 
and school personnel and for supporting the goals of the SLEP. 


Each school with an assigned SRO should provide work area(s) for the SRO that allow access to 
technologies, private interviewing of several persons, and locking storage space for securing physical 
evidence. 


The SD will handle discipline within the school disciplinary process without involving SROs. The SD 
policies, administrative guidance, training, and ongoing oversight should clearly communicate that 
school personnel are responsible for school discipline and that law enforcement is not to be involved 
with disciplinary action, except as may be requested by the SD (e.g., if factual information gathered or 
observations by the SRO are relevant to a disciplinary matter). The SD is responsible for 
communicating the goals and role of the SRO to all school administration, personnel, and students. 


The SD should ensure that school administrators meet the training requirements set forth in Virginia 
Code § 22.1-279.8(E). 
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Ill. SRO Roles and Responsibilities 


SROs should be considered active members of their assigned schools. The SRO facilitates the effective 
delivery of law enforcement services and assists with matters related to safety, security, and the 
exchange of information between the SD and the PD/SO. 


Unless there is a clear and imminent threat to safety, requests from school personnel for SRO or other 
law enforcement assistance are to be made to a school administrator and such administrator should, 
if appropriate, request assistance from the SRO. 


To the extent possible, SROs’ duty schedules should be organized to provide coverage throughout the 
school day. SROs provide a visible deterrent to crime and shall be visible patrolling the exterior and 
interior grounds. SROs should wear the regulation uniform of the employing PD/SO and operate a 
marked PD/SO vehicle while on duty unless otherwise authorized by the SRO’s supervisor. 


Additionally, SROs should assist school administrators in developing school crisis, emergency 
management, and medical emergency response plans. SROs should work with school administrators in 
problem-solving to prevent crime and promote safety in the school environment. SROs are expected 
to collaborate with school administrators and other school personnel to support positive school 
climates that focus on resolving conflicts and minimizing student involvement with the juvenile and 
criminal justice systems. 


SROs serve multiple roles in schools. The roles are interrelated but all are carried out with the aim to 
contribute to school safety and security and to promote positive and supportive school climates. The 
key roles of an SRO are: 


Law enforcement officer 

As a sworn law enforcement officer, the primary role of an SRO in a school is as a law enforcement 
officer. SROs assume primary responsibility for responding to requests for law enforcement 
assistance from school administrators and coordinating the response of other law enforcement 
resources to the school. SROs should work with school administrators in problem-solving to prevent 
crime and promote safety in the school environment. In all cases, the SRO’s role as a law 
enforcement officer should take precedence over any other roles performed by the SRO. 


Law-related educator 

As resources permit, SROs should strive to assist with presentations to school personnel on law- 
related topics such as law enforcement practices, changes in relevant laws, crime trends, crime 

prevention, school safety strategies, and crisis response procedures. SROs may also deliver law- 
related education to students using lessons/curricula approved in advance by the SD. 


Role model and informal mentor 

Students often seek approval, direction, and guidance from adults in the school setting about 
various problems. Through formal and informal interaction with students, SROs serve as role models 
and informal mentors. SROs are expected to communicate clearly to students about acceptable and 
unacceptable behavior, set a positive example in handling stressful situations and resolving conflicts, 
show respect and consideration of others, and express high expectations for student behavior. 
Students who may need additional assistance shall be referred to a school-based resource. 
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IV. School Administrator Roles and Responsibilities 


Consistent with the Virginia Standards for Accrediting Public Schools in Virginia, 8 VAC 20-131-210(A), 
“the principal is recognized as the instructional leader and manager of the school and is responsible 
for [flostering the success of all students by developing, advocating, and sustaining an academically 
rigorous, positive, and safe school climate for all stakeholders[.]” Additionally, pursuant to 8 VAC 20- 
131-260(D), the school administration should ensure that the school has written procedures “to follow 
in emergencies such as fire, injury, illness, allergic reactions, and violent or threatening behavior” and 
“for responding to violent, disruptive, or illegal activities by students on school property or during a 
school sponsored activity[.]” 


School administrators should review the MOU annually with SROs and establish school-specific 
operational and communications procedures to support the goals of the SLEP. 


OPERATIONAL PROCEDURES 


|. Differentiating Disciplinary Misconduct from Criminal Offenses 


School administrators and personnel are responsible for school discipline. Although SROs are 
expected to be familiar with the school division code of student conduct, the rules of individual 
schools, and their application in day-to-day practice, SROs should not be involved with the 
enforcement of school rules or disciplinary infractions that are not violations of law. 


Consequences of student misconduct should be effective, developmentally appropriate, and fair. 
Interventions and school sanctions should help students learn from their mistakes and address root 
causes of misconduct. School administrators should consider alternatives to suspensions and 
expulsions and law enforcement officials should consider alternatives to involvement with the juvenile 
and criminal justice systems for student violations of law. 


Il. Information Sharing 


The release and sharing of student records is governed by the Family Educational Rights and Privacy 
Act (FERPA), 20 U.S.C. § 1232g, and its implementing regulations, 34 C.F.R. Part 99, and §§ 22.1-287 and 
22.1-287.1 of the Code of Virginia. 


When appropriate, and to the extent allowable by law, the SD should notify SROs of any special needs 
of a student involved in a school-based infraction that is not routine discipline in order to assist the 
SRO in recognizing and accommodating behaviors that may be manifestations of the student’s 
disability. 


Consent access. An SRO or other law enforcement officer may have access to a student’s education 
records with written consent of the student’s parent or legal guardian or of the student if the student 
is 18 years or age or older. 


SRO access. For purposes of access to student records, SROs may be considered “school officials with 
a legitimate educational interest” in reviewing information from student education records covered 
by FERPA, and may be provided student information as needed to carry out their duties related to the 
school environment, provided such SROs perform a function or service for which the school would 
otherwise use employees (e.g., maintaining the physical safety and security of the school) and 
comply with the use and re-disclosure requirements set forth in 34 C.F.R. § 99.33. SROs may have 
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access to (i) information on students in their assigned schools that include directory information and 
additional items needed to carry out their duties, such as class schedules, as approved by the school 
administrator, and (ii) directory information for all students in the school division (however, unless 
they are school officials with a legitimate educational interest, they will not have address to student 
addresses, telephone numbers or email addresses unless another exception applies, given § 21.1- 
287.1 of the Code of Virginia). While, as noted above, SROs are always under the control of the PD/SO 
in carrying out their law enforcement duties, the PD/SO agree that SROs will respect the 
confidentiality of student education records as other school officials would, and are under the control 
of the SD when it comes to the handling of student education records. PD/SOs understand that unless 
a FERPA exception applies that would permit disclosure to law enforcement by any school official (e.g., 
in the context of a health or safety emergency or in response to a subpoena), SROs will not share 
protected student record information with the PD/SO. 


Health or Safety Emergency Exception. Pursuant to 34 C.F.R. § 99.36, in the event of an articulable 
and significant threat to the health or safety of a student or other individuals, school officials may 
disclose any information from student records to appropriate parties, including law enforcement 
officials, whose knowledge of the information is necessary to protect the health or safety of the 
student or other individuals. 


SRO disclosure of law enforcement records. SROs may disclose law enforcement records created and 
maintained by the SRO for the purpose of maintaining the physical security and safety of the school or 
the enforcement of laws. Because law enforcement records are not student records, they are not 
subject to the disclosure requirements of FERPA. 


Ill. Investigation and Questioning 


SROs have the authority to question students who may have information about criminal activity. As 
sworn law enforcement officers, SROs have authority to stop, question, interview, and take law 
enforcement action without prior authorization of the school administrator or contacting parents or 
legal guardians. However, the investigation and questioning of students during school hours or at 
school events should be limited to situations where the investigation is related to suspected criminal 
activity related to the operation of or occurring at the school. The investigation and questioning of 
students for offenses not related to the operation of or occurring at the school should take place at 
school only when delay might result in danger to any person, destruction of evidence, or flight from 
the jurisdiction by the person suspected of a crime. 


The interviewing of students, whether as suspects, victims, or witnesses, should be conducted 
privately in an office setting. SROs shall take steps to ensure minimal intrusion into the educational 
experience of students being questioned in the school setting. 


SROs are responsible for leading the investigation and questioning of students related to suspected 
violations of criminal law. SROs shall not be included in the investigation and questioning of students 
about student code of conduct violations that do not involve any criminal activity or risk of harm to 
self or others. School administrators are responsible for the investigation and questioning of students 
about violations of the code of conduct. 


IV. Searches 


All searches shall be conducted in accordance with federal and state laws and applicable SD and 
PD/SO policies and guidelines, including the principles embodied in this MOU. 
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School administrator searches. School personnel may conduct searches of a student's property and 
person under their jurisdiction in accordance with guidelines developed as contemplated by Code of 
Virginia § 22.1-279.7, and the advice of the school’s legal counsel. 


SRO searches. Any search initiated by an SRO or other law enforcement officer should be conducted in 
accordance with constitutional search and seizure requirements. All searches should occur outside 
the presence of students and school personnel, with the exception of school administrators, unless 
there is a clear and imminent threat to safety. 


SROs should not become involved in administrative searches and at no time should SROs request that 
an administrative search be conducted for law enforcement purposes or have school personnel 
conduct a search as the SRO’s agent. 


V. Arrests 


Whenever practical, the arrest of a student or school personnel should be accomplished outside of 
school hours in order to not disrupt the educational process or school setting. Arrests that must occur 
during school hours or on school grounds should be coordinated through the school administrator to 
minimize potential disruption. When circumstances do not allow for prior coordination through the 
school administrator, arrests should be reported to the school administrator as soon as possible. In 
addition to any required notification of parents and legal guardians by the SRO taking a student or 
employee into custody, school administrators or their designees should consider notifying parents and 
legal guardians upon a school-based arrest of the student. 


VI. Physical Restraint by School Personnel 


Physical restraint refers to restricting a student’s ability to freely move his or her torso, arms, legs, or 
head. The term physical restraint does not include a physical escort, such as temporary touching of the 
arm or other body part for the purpose of inducing a student who is acting out to walk to a safe 
location. 


Physical restraint by school personnel is used in accordance with Virginia Board of Education policies 
and guidelines on seclusion and restraint and related local school board policies. Every effort should 
be made by school personnel to prevent the need for the use of restraint. Physical restraint should not 
be used except by school personnel trained in the use of physical restraint as required by the school 
division. 


School personnel should act to de-escalate situations that are causing, or have the potential to cause, 
disruptions to the school environment and/or are violations of the student code of conduct. If physical 
intervention is necessary, the action shall be reported promptly to the school administrator and the 
rationale for the action shall be fully documented. 


VII. Physical Intervention by School Resource Officers 


An SRO should not be involved in the physical restraint of a student unless there is a clear and 
imminent threat to safety. As sworn law enforcement officers, SROs may intervene to de-escalate 
situations. 


Physical intervention by SROs is undertaken in accordance with policies and operational procedures of 
the PD/SO and state law regarding physical intervention and use of force by a law enforcement officer. 
If an SRO is involved in the use of restraint or physical intervention, the action should be reported to 
the school administrator and the SRO’s supervisor and the rationale for the action should be fully 
documented. 
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SROs should be aware of the Virginia Board of Education’s policies and guidelines on seclusion and 
restraint and related local school board policies and may attend training offered by the local school 
system on their use of seclusion and restraint by school personnel. However, SROs should continue 
to operate by the policies and operational procedures of the PD/SO and state law regarding physical 
intervention and use of force by a law enforcement officer. 


Additionally, if the SRO physically intervenes with a student, the SD and PD/SO should coordinate to 
ensure that reasonable effort is made to inform the parents or legal guardians of such student on the 
same day as the occurrence of the physical intervention. 


KEY STATUTORY RESPONSIBILITIES 


|. Crime Reporting 


Pursuant to Virginia Code § 22.1-279.3:1(B), law enforcement agencies are required, among other 
things, to notify the division superintendent and the principal or the principal’s designee when a 
student in the principal’s school commits (i) any offense that would be a felony if committed by an 
adult or (ii) any offense listed in Virginia Code § 22.1-279.3:1(A) that would be a misdemeanor if 
committed by an adult if such offense was committed on a school bus, on school property, or at a 
school-sponsored activity and whether the student is released to the custody of his parent or legal 
guardian or released on bond. 


Pursuant to §§ 16.1-260(G) and 19.2-83.1(B), law enforcement agencies and/or intake officers are 
required to notify the division superintendent if a student is arrested for certain offenses or subject to 
a petition alleging that the student committed certain offenses. Division superintendents who receive 
such reports are required to report the information to the principal of the school in which the student 
is enrolled. 


As a general practice, SROs should notify the principal as soon as practical of any significant law 
enforcement events occurring at or in association with the school (e.g., at a school bus stop or off- 
campus activity, during or outside school hours). 


Pursuant to Virginia Code § 22.1-279.3:1(D), certain types of criminal activity committed on a school 
bus, on school property, or at a school-sponsored activity that come to the attention of the principal 
or school personnel should be reported immediately to the PD/SO as specified in SD policy. No SRO or 
school administrator will be required to file delinquency charges in response to any such activity. 
After such notification is made to PD/SO, the SD will ascertain the disposition of the incident made by 
the PD/SO in order to complete the optional Model School/Law Enforcement Incident Report form. 
Schools and SROs should be encouraged to deal with school-based offenses through graduated 
sanctions or educational programming before a delinquency charge is filed with the juvenile court. 


ll. Threat Assessment 


Threat assessments will be conducted in accordance with local school board policies adopted as 
required by Virginia Code § 22.1-79.4 and, in general, consistent with model procedures and guidelines 
published by the DCJS Virginia Center for School and Campus Safety and other appropriate practices. 


SROs may serve as members of threat assessment teams (including as school officials with a 


legitimate education interest, as defined by FERPA and as discussed above) and assist in the 
monitoring of subject students as well as determining the need, if any, for law enforcement action. 
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Ill. School Safety Audits 


School safety audits will be conducted annually as required by Virginia Code § 22.1-279.8 to assess 
school safety conditions in schools. SROs, in collaboration with school administrators, will conduct 
school inspection walk-throughs using a standardized checklist developed by the Center for School and 
Campus Safety. SROs should collaborate in other school safety audit mandates set forth in Virginia 
Code § 22.1-279.8, including school crisis, emergency management, and medical emergency response 
planning and preparation. 


REVIEW OF MOU 


Effective July 1, 2020, per an amendment to Virginia Code § 22.1-280.2:3 “school boards and local law 
enforcement agencies shall review and amend or affirm memorandums of understanding at least 
once every two years, or at any time upon the request of either party”. Further, “each school board 
shall ensure the current division memorandum of understanding is conspicuously published on the 
division website and provide notice and opportunity for public input and discussion during each 
memorandum of understanding review period.” 


Quarterly meetings should be conducted throughout the year between the SD point of contract and 
PD/SO point of contact to support successful implementation of the partnership. This MOU remains in 
force until such time as either party withdraws from the agreement by delivering a written 
notification of such withdrawal to the other party at least 45 days prior to the date of withdrawal. 


Signed: 
Chief of Police/Sheriff Superintendent of Schools 
Date Date 
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Appendix A 
Graduated Intervention and Responses 


In developing the School-Law Enforcement Partnership MOU, the School Division and Law Enforcement 
Agency are encouraged to develop alternative responses and educational programming for school-based 
misconduct in order to divert youth from unnecessary involvement with the juvenile justice systems. 


Examples of graduated response programs used by school divisions and law enforcement agencies in 
other states can be found in these agreements and MOUs. 


Clayton County, Georgia 

Inter-Agency Governance Agreement on the Handling of School Offenses Between the Clayton County 
Public School System and Clayton County Juvenile Court (2013) 

www. jdaihelpdesk.org/casemodpolicies/Handling%200f%20School%200ffenses%20MOU%20(Clayton% 
20County,%20GA).pdf 


Hartford, Connecticut 

Memorandum of Agreement By and Between Hartford Public Schools and Hartford Police Department 
(2012) 
https://www.cga.ct.gov/2014/JUDdata/Tmy/2014SB-00054-R000224-Hartford%20Police%20Dept.%20- 
%20James%20C.%20Rovella-TMY.PDF 


San Francisco, California 
Memorandum of Understanding Between the San Francisco Police Department and the San Francisco 
Unified School District (2014) 


www.dignityinschools.org/sites/default/files/SFPD-SRO-MOU. pdf 
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